CVE-2022-41936: XWiki

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.

Affected products

• XWiki XWiki: from 8.1, before 13.10.8 (fixed in 13.10.8); from 14.0, before 14.4.3 (fixed in 14.4.3); from 14.5, before 14.6 (fixed in 14.6)

Published 2022-11-22. Last modified 2026-06-17.