VYPR
Get started
← All advisories
High severityNVD Advisory· Published Mar 19, 2025· Updated Mar 19, 2025

The WikiManager REST API allows any user to create wikis

CVE-2025-29926

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-wiki-rest-defaultMaven
>= 5.4-rc-1, < 15.10.1515.10.15
org.xwiki.platform:xwiki-platform-wiki-rest-defaultMaven
>= 16.0.0-rc-1, < 16.4.616.4.6
org.xwiki.platform:xwiki-platform-wiki-rest-defaultMaven
>= 16.5.0-rc-1, < 16.10.016.10.0

Affected products

1

Patches

1
82aa670106c7

XWIKI-22490: Missing checks in WikiManager REST API

https://github.com/xwiki/xwiki-platformSimon UrliNov 21, 2024via ghsa
commit
2 files changed · +19 −2
  • xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-rest/xwiki-platform-wiki-rest-default/src/main/java/org/xwiki/wiki/rest/internal/DefaultWikiManagerREST.java+12 −1 modified
    @@ -25,11 +25,13 @@
 import javax.inject.Named;
 import javax.ws.rs.POST;
 import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 
 import org.xwiki.component.annotation.Component;
 import org.xwiki.model.reference.EntityReferenceSerializer;
+import org.xwiki.model.reference.WikiReference;
 import org.xwiki.rest.Relations;
 import org.xwiki.rest.XWikiResource;
 import org.xwiki.rest.XWikiRestException;
@@ -42,6 +44,8 @@
 import org.xwiki.rest.resources.wikis.WikiResource;
 import org.xwiki.rest.resources.wikis.WikiSearchQueryResource;
 import org.xwiki.rest.resources.wikis.WikiSearchResource;
+import org.xwiki.security.authorization.AuthorizationManager;
+import org.xwiki.security.authorization.Right;
 import org.xwiki.wiki.descriptor.WikiDescriptor;
 import org.xwiki.wiki.descriptor.WikiDescriptorManager;
 import org.xwiki.wiki.manager.WikiManager;
@@ -73,12 +77,19 @@ public class DefaultWikiManagerREST extends XWikiResource implements WikiManager
     @Inject
     private EntityReferenceSerializer<String> entityReferenceSerializer;
 
+    @Inject
+    private AuthorizationManager authorizationManager;
+
     @Override
     @POST
     public Response createWiki(@QueryParam("template") String template, Wiki wiki) throws XWikiRestException
     {
         XWikiContext xcontext = getXWikiContext();
         WikiDescriptor descriptor = null;
+        WikiReference mainWikiReference = new WikiReference(wikiDescriptorManager.getMainWikiId());
+        if (!this.authorizationManager.hasAccess(Right.CREATE_WIKI, xcontext.getUserReference(), mainWikiReference)) {
+            throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+        }
 
         try {
             // Find the wiki owner
@@ -132,7 +143,7 @@ public Response createWiki(@QueryParam("template") String template, Wiki wiki) t
      * @param description the wiki description.
      * @return the wiki model object.
      */
-    public static Wiki createWiki(ObjectFactory objectFactory, URI baseUri, String wikiName, String owner,
+    private static Wiki createWiki(ObjectFactory objectFactory, URI baseUri, String wikiName, String owner,
             String description)
     {
         Wiki wiki = objectFactory.createWiki().withId(wikiName).withName(wikiName).withOwner(owner)
  • xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-test/xwiki-platform-wiki-test-docker/src/test/it/org/xwiki/wiki/test/ui/WikiManagerRestIT.java+7 −1 modified
    @@ -47,14 +47,20 @@ class WikiManagerRestIT
     @Order(1)
     void testCreateWiki(TestUtils setup) throws Exception
     {
+        setup.createUser("CreateWikiTest", "CreateWikiTestPWD", null);
+        setup.login("CreateWikiTest", "CreateWikiTestPWD");
         String wikiId = "foo";
 
         Wiki wiki = new Wiki();
         wiki.setId(wikiId);
+        wiki.setName("test");
+        wiki.setName("Some description");
+        PostMethod postMethod = setup.rest().executePost(WikiManagerREST.class, wiki);
+        assertEquals(HttpStatus.SC_UNAUTHORIZED, postMethod.getStatusCode());
 
         // Need admin right to create a wiki
         setup.setDefaultCredentials(TestUtils.SUPER_ADMIN_CREDENTIALS);
-        PostMethod postMethod = setup.rest().executePost(WikiManagerREST.class, wiki);
+        postMethod = setup.rest().executePost(WikiManagerREST.class, wiki);
         assertEquals(HttpStatus.SC_CREATED, postMethod.getStatusCode());
 
         try (InputStream stream = postMethod.getResponseBodyAsStream()) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.