CVE-2025-29925

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

• CWE-402

• https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2dfPatch
• https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744vVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22630Exploit, Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22639Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22630Exploit, Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22639Issue Tracking, Vendor Advisory

Published

Mar 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29917Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2025-29918Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2025-2992A vulnerability classified as critical was found in Tenda FH…6.9
• CVE-2025-29922kcp is a Kubernetes-like control plane for form-factors and …9.6
• CVE-2025-29923go-redis is the official Redis client library for the Go pro…3.7
• CVE-2025-29924XWiki Platform is a generic wiki platform. Prior to 15.10.14…7.5
• CVE-2025-29926XWiki Platform is a generic wiki platform. Prior to 15.10.15…9.8
• CVE-2025-29927Next.js is a React framework for building full-stack web app…9.1
• CVE-2025-29928authentik is an open-source identity provider. Prior to vers…8
• CVE-2025-29929Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-2993A vulnerability, which was classified as critical, has been …6.9
• CVE-2025-29930imFAQ is an advanced questions and answers management system…6.9