PT-2026-32970 · Xwiki · Xwiki Platform

Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-40104

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 16.10.16 XWiki Platform versions prior to 17.4.8 XWiki Platform versions prior to 17.10.1

Description Resource exhaustion can occur in REST API endpoints, such as '/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties', which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this process can exhaust available server resources.

Recommendations Update to version 16.10.16. Update to version 17.4.8. Update to version 17.10.1.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-40104

GHSA-MRQG-XMGM-RC5G

Affected Products

Xwiki Platform

References · 7

• https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7 · Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40104 · Security Note
• https://osv.dev/vulnerability/GHSA-mrqg-xmgm-rc5g · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-23550 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CVEnew/status/2044338859308433794 · Twitter Post