CVE-2023-26471

XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.

• CWE-284

• https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20234Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20234Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Mar 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26466A user with non-Admin access can change a configuration file…7.8
• CVE-2023-26467A man in the middle can redirect traffic to a malicious serv…5.4
• CVE-2023-26468Cerebrate 1.12 does not properly consider organisation_id du…9.1
• CVE-2023-26469In Jorani 1.0.0, an attacker could leverage path traversal t…9.8
• CVE-2023-2647A vulnerability was found in Weaver E-Office 9.5 and classif…8.8
• CVE-2023-26470XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2023-26472XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26473XWiki Platform is a generic wiki platform. Starting in versi…6.5
• CVE-2023-26474XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26475XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26476XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-26477XWiki Platform is a generic wiki platform. Starting in versi…9.8