Any user with view access to the XWiki space can change the authenticator
Description
XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space (by default, anyone) can access the page XWiki.Authentication.Administration and (unless an authenticator is set in xwiki.cfg) switch to another installed authenticator. Note that, by default, there is only one authenticator available (Standard XWiki Authenticator). So, if no authenticator extension was installed, it's not really possible to do anything for an attacker. Also, in most cases, if an SSO authenticator is installed and utilized (like OIDC or LDAP for example), the worst an attacker can do is break authentication by switching back to the standard authenticator (that's because it's impossible to login to a user which does not have a stored password, and that's usually what SSO authenticator produce). This issue has been patched in versions 15.10.14, 16.4.6, and 16.10.0-rc-1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.platform:xwiki-platform-security-authentication-uiMaven | >= 15.3-rc-1, < 15.10.14 | 15.10.14 |
org.xwiki.platform:xwiki-platform-security-authentication-uiMaven | >= 16.0.0-rc-1, < 16.4.6 | 16.4.6 |
org.xwiki.platform:xwiki-platform-security-authentication-uiMaven | >= 16.5.0-rc-1, < 16.10.0-rc-1 | 16.10.0-rc-1 |
Affected products
1- Range: >= 15.3-rc-1, < 15.10.14
Patches
15efc31cea150XWIKI-22603: Improve rights setup
1 file changed · +123 −0
xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-ui/src/main/resources/XWiki/Authentication/WebPreferences.xml+123 −0 added@@ -0,0 +1,123 @@ +<?xml version="1.1" encoding="UTF-8"?> + +<!-- + * See the NOTICE file distributed with this work for additional + * information regarding copyright ownership. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. +--> + +<xwikidoc version="1.5" reference="XWiki.Authentication.WebPreferences" locale=""> + <web>XWiki.Authentication</web> + <name>WebPreferences</name> + <language/> + <defaultLanguage/> + <translation>0</translation> + <creator>xwiki:XWiki.Admin</creator> + <parent>XWiki.Authentication.WebHome</parent> + <author>xwiki:XWiki.Admin</author> + <contentAuthor>xwiki:XWiki.Admin</contentAuthor> + <version>1.1</version> + <title>Preferences</title> + <comment/> + <minorEdit>false</minorEdit> + <syntaxId>xwiki/2.1</syntaxId> + <hidden>true</hidden> + <content/> + <object> + <name>XWiki.Authentication.WebPreferences</name> + <number>0</number> + <className>XWiki.XWikiGlobalRights</className> + <guid>a33e9024-b5d3-425c-8a8a-32cc40381c3a</guid> + <class> + <name>XWiki.XWikiGlobalRights</name> + <customClass/> + <customMapping/> + <defaultViewSheet/> + <defaultEditSheet/> + <defaultWeb/> + <nameField/> + <validationScript/> + <allow> + <defaultValue>1</defaultValue> + <disabled>0</disabled> + <displayFormType>select</displayFormType> + <displayType>allow</displayType> + <name>allow</name> + <number>4</number> + <prettyName>Allow/Deny</prettyName> + <unmodifiable>0</unmodifiable> + <classType>com.xpn.xwiki.objects.classes.BooleanClass</classType> + </allow> + <groups> + <cache>0</cache> + <disabled>0</disabled> + <displayType>input</displayType> + <multiSelect>1</multiSelect> + <name>groups</name> + <number>1</number> + <picker>1</picker> + <prettyName>Groups</prettyName> + <relationalStorage>0</relationalStorage> + <separator> </separator> + <size>5</size> + <unmodifiable>0</unmodifiable> + <classType>com.xpn.xwiki.objects.classes.GroupsClass</classType> + </groups> + <levels> + <cache>0</cache> + <disabled>0</disabled> + <displayType>select</displayType> + <multiSelect>1</multiSelect> + <name>levels</name> + <number>2</number> + <prettyName>Levels</prettyName> + <relationalStorage>0</relationalStorage> + <separator> </separator> + <size>3</size> + <unmodifiable>0</unmodifiable> + <classType>com.xpn.xwiki.objects.classes.LevelsClass</classType> + </levels> + <users> + <cache>0</cache> + <disabled>0</disabled> + <displayType>input</displayType> + <multiSelect>1</multiSelect> + <name>users</name> + <number>3</number> + <picker>1</picker> + <prettyName>Users</prettyName> + <relationalStorage>0</relationalStorage> + <separator> </separator> + <size>5</size> + <unmodifiable>0</unmodifiable> + <classType>com.xpn.xwiki.objects.classes.UsersClass</classType> + </users> + </class> + <property> + <allow>1</allow> + </property> + <property> + <groups>XWiki.XWikiAdminGroup</groups> + </property> + <property> + <levels>view,edit,delete,comment,script,admin</levels> + </property> + <property> + <users/> + </property> + </object> +</xwikidoc>
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-f9c6-2f9p-82jjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-46557ghsaADVISORY
- github.com/xwiki/xwiki-platform/commit/5efc31cea1501c9a5cb593566fea8b558ff32a2aghsax_refsource_MISCWEB
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-f9c6-2f9p-82jjghsax_refsource_CONFIRMWEB
- jira.xwiki.org/browse/XWIKI-22604ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.