XWiki's REST APIs can list all pages/spaces, leading to unavailability
### Impact REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis. ### Patches This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1. ### Workarounds We're not aware of any workarounds apart from upgrading the affected modules.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-40104US | — | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/xwiki/xwiki-platformPACKAGE
- https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7WEB
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5gWEB
- https://jira.xwiki.org/browse/XWIKI-23550WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-40104ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan