VYPR
Critical severityNVD Advisory· Published Nov 23, 2022· Updated Apr 22, 2025

org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users

CVE-2022-41930

Description

org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page XWiki.XWikiUserProfileSheet in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-user-profile-uiMaven
>= 12.4, < 13.10.713.10.7
org.xwiki.platform:xwiki-platform-user-profile-uiMaven
>= 14.0.0, < 14.4.214.4.2

Affected products

1

Patches

1
5be1cc0adf91

XWIKI-19792: User should not be able to disable themselves

https://github.com/xwiki/xwiki-platformSimon UrliJun 9, 2022via ghsa
1 file changed · +3 2
  • xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-profile/xwiki-platform-user-profile-ui/src/main/resources/XWiki/XWikiUserProfileSheet.xml+3 2 modified
    @@ -37,9 +37,10 @@
       <syntaxId>xwiki/2.0</syntaxId>
       <hidden>true</hidden>
       <content>{{velocity}}
    -#if ("$!request.userId" != "" &amp;&amp; ($request.action == "disable" || $request.action == "enable") &amp;&amp; $services.csrf.isTokenValid($request.csrf))
    +#if ($hasAdmin &amp;&amp; "$!request.userId" != "" &amp;&amp; ($request.action == "disable" || $request.action == "enable") &amp;&amp; $services.csrf.isTokenValid($request.csrf))
     #set ($user = $xwiki.getUser($request.userId))
    -#if ($user.getUser().exists($xcontext.context))
    +#set ($isCurrentUser = $user.getUser().userReference.equals($xcontext.userReference))
    +#if (!$isCurrentUser &amp;&amp; $user.getUser().exists($xcontext.context))
       #set ($disabled = ($request.action == "disable"))
       #set ($discard = $user.setDisabledStatus($disabled))
       #set ($success = ($disabled &amp;&amp; $user.isDisabled()) || (!$disabled &amp;&amp; !$user.isDisabled()))
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.