{"cve":"CVE-2023-26471","nvd":{"published":"2023-03-02T19:15:11.137","modified":"2026-06-17T05:43:24.447","status":"Modified","description":"XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-284"],"references":["https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7","https://jira.xwiki.org/browse/XWIKI-20234","https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7"],"products":["xwiki:xwiki"],"source":"nvd","synced_at":"2026-10-19T21:37:41.955480748+00:00"},"epss":{"cve":"CVE-2023-26471","score":0.0092,"percentile":0.60296,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9cqm-5wf7-wcj7","url":"https://osv.dev/vulnerability/GHSA-9cqm-5wf7-wcj7","summary":"XWiki Platform users may execute anything with superadmin right through comments and async macro","modified":"2023-11-08T04:12:01.351906Z","packages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-rendering-async-macro","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-rendering-async-macro","ranges":[">=11.6-rc-1 <13.10.10"],"fixed":["13.10.10"]},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-rendering-async-macro","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-rendering-async-macro","ranges":[">=14.0 <14.4.6"],"fixed":["14.4.6"]},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-rendering-async-macro","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-rendering-async-macro","ranges":[">=14.5 <14.9"],"fixed":["14.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}