VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 23, 2022· Updated Apr 22, 2025

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

CVE-2022-41929

Description

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-oldcoreMaven
>= 11.7RC1, < 13.10.713.10.7
org.xwiki.platform:xwiki-platform-oldcoreMaven
>= 14.0.0, < 14.4.214.4.2

Affected products

1

Patches

1
0b732f2ef022

XWIKI-19804: Bulletproof user API

https://github.com/xwiki/xwiki-platformSimon UrliJun 9, 2022via ghsa
commit
1 file changed · +3 −1
  • xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java+3 −1 modified
    @@ -92,7 +92,9 @@ public XWikiUser getUser()
      */
     public void setDisabledStatus(boolean disabledStatus)
     {
-        this.user.setDisabled(disabledStatus, getXWikiContext());
+        if (hasAdminRights()) {
+            this.user.setDisabled(disabledStatus, getXWikiContext());
+        }
     }
 
     /**

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.