CVE-2024-21648: XWiki

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.

Affected products

• XWiki XWiki: before 14.10.17 (fixed in 14.10.17); from 15.0, before 15.5.3 (fixed in 15.5.3); from 15.6, before 15.8 (fixed in 15.8)

Published 2024-01-09. Last modified 2026-06-17.