CVE-2025-46557 is a critical missing authorization flaw (CVSS 9.8) in XWiki. A visitor who can open pages in the XWiki space can reach the authentication administration page and switch authenticators. Fixed in 15.10.14, 16.4.6 and 16.10.0-rc-1. A permissions change is a workaround.
What's affected
The NVD record lists three affected ranges: 15.3-rc-1 up to but not including 15.10.14, 16.0.0-rc-1 up to but not including 16.4.6, and 16.5.0-rc-1 up to but not including 16.10.0-rc-1. The GitHub advisory lists the patched versions as 15.10.14, 16.4.6 and 16.10.0-rc-1.
The advisory text also mentions earlier patch numbers (15.10.9 and 16.3.0RC1) in its prose. The version fields are the stricter statement, so plan around 15.10.14, 16.4.6 or 16.10.0-rc-1 and confirm in the advisory.
The real impact depends on your setup. By default only the standard authenticator is installed, so the record says an attacker can do little unless another authenticator extension is present. With an SSO authenticator such as OIDC or LDAP, the worst described outcome is breaking authentication by switching back to the standard one.
How to check if you're exposed
Check the XWiki version and your authenticator setup.
- In XWiki, open the About page or the administration section and read the platform version.
- Docker users: run the command shown below and read the xwiki image tag.
- Look in xwiki.cfg for the xwiki.authentication.authclass setting. The record says that when an authenticator is set there, the switch described does not apply in the same way.
- Check the extensions list for installed authenticator extensions.
- Check the rights on the page XWiki.Authentication. The advisory workaround is to make sure only the admin user holds the VIEW right on that space.
Commands referred to above, in order:
docker ps --format '{{.Image}}'
What to do now
- Upgrade to 15.10.14, 16.4.6, 16.10.0-rc-1 or a later release on the branch you run.
- If you cannot upgrade now, apply the advisory workaround: in the page and children rights of XWiki.Authentication, allow only the admin user the VIEW right.
- Set the authenticator explicitly in xwiki.cfg so it cannot be switched from the interface.
- Check your login and SSO flows after any change to confirm that users can still sign in.
- Review recent configuration changes for an unexpected switch of the authenticator.
- Keep an inventory of XWiki extensions so that you can see which ones add authentication paths.
Why it matters
The record lists CWE-862 (Missing Authorization). Missing authorization means an administrative page was reachable by people who should not see it. In this case the page controls which authentication method the wiki uses, which is among the most sensitive settings in the system.
The score of 9.8 follows the worst case in the vector: network reach, no login and high impact. The advisory is frank that real impact depends on which authenticators are installed. That is a good example of why a base score alone is a poor guide, and why checking your own configuration is worth the ten minutes. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Can I fix this without upgrading?
The advisory gives a workaround: limit the VIEW right on the XWiki.Authentication space to the admin user. Upgrading is still the lasting fix.
Is a default install in trouble?
The advisory says that with only the standard authenticator installed there is little an attacker can do, but upgrade anyway.
Sources
Last reviewed: 18 October 2026.
