CVE-2025-29925: 
Java vulnerability analysis and mitigation

XWiki Platform, a generic wiki platform, was found to have a security vulnerability (CVE-2025-29925) where protected pages were accessible through REST endpoints even without proper authorization. The vulnerability affects versions prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, discovered and disclosed on March 19, 2025. The issue specifically impacts the /rest/wikis/[wikiName]/pages endpoint, where pages would be listed even if the user doesn't have view rights on them (GitHub Advisory).

The vulnerability stems from improper access control in the REST API implementation. When requesting the /rest/wikis/[wikiName]/pages endpoint, the system failed to properly validate user permissions before listing pages. This was particularly problematic when the wiki was configured with 'Prevent unregistered user to view pages' setting, as the endpoint would still list the pages of the wiki, though only for the main wiki due to a related issue (XWIKI-22639). The vulnerability has been assigned a CVSS v4.0 score of 8.7 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (GitHub Advisory).

The vulnerability allows unauthorized users, particularly guest users, to access information about protected pages that they shouldn't have access to. This represents a significant data leak vulnerability as it exposes metadata about private pages, including their existence, titles, and structure, even when these pages are supposed to be hidden from unauthorized users (XWIKI-22630).

The vulnerability is easily exploitable through network access, requiring no special privileges or user interaction. An attacker can simply make HTTP requests to the REST endpoint /rest/wikis/[wikiName]/pages to obtain information about protected pages. The attack can be performed remotely without any authentication (GitHub Advisory).

The vulnerability has been patched in XWiki versions 15.10.14, 16.4.6, and 16.10.0-rc-1. In these versions, the endpoint can still be requested, but the results are properly filtered based on page access rights. For users unable to upgrade immediately, there is no workaround except manually applying the changes from the patch commits and recompiling the xwiki-platform-rest-server (GitHub Advisory).