CVE-2025-29926 is a critical (CVSS 9.8) missing authorization flaw in the XWiki WikiManager REST API. Any user can create a wiki and become its administrator. Update the REST module to 15.10.15, 16.4.6 or 16.10.0. The API is not bundled by default.
What's affected
XWiki Platform versions before 15.10.15, 16.4.6 and 16.10.0 are affected, specifically the REST module for wiki management. The GitHub advisory lists the Maven package org.xwiki.platform:xwiki-platform-wiki-rest-default.
Fixed versions are 15.10.15, 16.4.6 and 16.10.0 of the REST module.
The advisory says the REST API is not bundled in XWiki Standard by default. It needs to be installed manually through the extension manager, so many installations are not exposed. The advisory also says there is no workaround other than upgrading. The record does not flag the CVE as known exploited.
How to check if you're exposed
First decide whether the module is installed at all.
- In the XWiki administration, open the Extension Manager and look for the Wiki Manager REST extension in the installed list.
- If you build XWiki from Maven, run mvn dependency:tree and search for xwiki-platform-wiki-rest-default.
- Note the version and compare it with the fixed versions above.
If the REST extension is not installed, the advisory's conditions are not met for your wiki, but check again after any future extension installs.
What to do now
- Check the Extension Manager for the Wiki Manager REST extension on every XWiki instance.
- If it is installed and below a fixed version, upgrade it to 15.10.15, 16.4.6 or 16.10.0, matching your release line.
- If you do not need the REST API for wiki management, uninstall the extension.
- Review the list of wikis and administrators on farms where the API was installed, and remove ones you did not create.
- Keep an eye on the XWiki security advisories for later issues.
Why it matters
The record maps the flaw to CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The endpoint that creates new wikis did not check whether the caller was allowed to create one. Because the creator can become administrator of the new wiki, an ordinary user gains a powerful position inside a wiki farm.
The advisory notes that this lets a user perform other attacks on the farm. A wiki farm hosts many sub wikis under one installation, so control over one wiki, plus a shared server, can be a stepping stone. That is why a missing permission check in a management API is rated so high.
The condition that the extension must be installed manually is a useful reminder: optional extensions widen the attack surface and still need to be tracked in your inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a default XWiki install affected?
The advisory says the REST API is not bundled in XWiki Standard by default. It is only a risk if the extension was installed.
Is there a workaround?
The advisory says there is none other than upgrading.
Sources
Last reviewed: 19 October 2026.
