CVE-2025-32973
Published: 30 April 2025
Summary
CVE-2025-32973 is a critical-severity Missing Authorization (CWE-862) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.0 (Critical).
Operationally, ranked in the top 30.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki is a generic wiki platform affected by an authorization flaw tracked as CVE-2025-32973. In releases 15.9-rc-1 through 15.10.11, 16.0.0-rc-1 through 16.4.2, and 16.5.0-rc-1 through 16.7.x, the platform fails to display any warning when a user holding programming rights edits a page whose most recent author lacked those rights yet contains an XWiki.ComponentClass object; the edit therefore silently confers programming rights on the object. The issue is classified under CWE-862 and carries a CVSS 3.1 score of 9.0.
An attacker who possesses only edit rights on a single page can insert a malicious ComponentClass object and then rely on any administrator or programming-rights user subsequently editing that page to activate the object, thereby obtaining full programming rights on the wiki. No other interaction or privilege escalation path is required beyond the initial placement and the subsequent edit by a privileged user.
Public advisories and the accompanying patches state that the vulnerability is resolved in XWiki 15.10.12, 16.4.3, and 16.8.0-rc-1. The fix and associated commit are documented in the GitHub Security Advisory GHSA-x7wv-5qg4-vmr6 and the linked XWiki Jira ticket XWIKI-22460.
EPSS for the CVE rose from a low baseline to a peak of 0.0224 on 2026-02-24 before receding to the current value of 0.0058, indicating a measurable increase in exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12741
Vulnerability details
XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited…
more
by a user without programming rights and contains an XWiki.ComponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a malicious object could use this to gain programming rights on the wiki. For this, the attacker needs to have edit rights on at least one page to place this object and then get an admin user to edit that document. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.