CVE-2007-4888: XWiki

Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable.

Affected products

• XWiki XWiki: version 1.0_b1 only; version 1.0_b2 only

Published 2007-09-14. Last modified 2026-06-16.