CVE-2025-54990: 
Java vulnerability analysis and mitigation

CVE-2025-54990 is an incorrect default permissions vulnerability in the XWiki AdminTools application (Pro) that allows unauthenticated network users to access the AdminTools.SpammedPages administrative page without authorization. The flaw affects all versions of com.xwiki.admintools:application-admintools up to and including 1.0.1, and was disclosed on November 18, 2025, by project lead Sorin Chiuchiu. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, GHSA).

The root cause is classified as CWE-276 (Incorrect Default Permissions): the AdminTools space in XWiki does not have view rights restricted to the XWikiAdminGroup by default, leaving the AdminTools.SpammedPages page accessible to any user, including unauthenticated ones (GitHub Advisory). An attacker can exploit this by simply navigating to the AdminTools.SpammedPages URL on a vulnerable XWiki instance over the network — no credentials, special tools, or complex techniques are required. While the advisory notes that no data is rendered to non-admin users, the page itself remains reachable, indicating a missing access control enforcement at the space level (GHSA).

The primary impact is a low-severity confidentiality breach: unauthenticated or low-privileged users can access an administrative page that should be restricted to XWiki administrators. Although the advisory states no data is currently visible to non-admin users on the page, the improper access control configuration could expose administrative interface structure and potentially sensitive instance metadata depending on future content changes. There is no integrity or availability impact associated with this vulnerability (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.041% (13th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible XWiki instances running the AdminTools Pro application (versions ≤ 1.0.1) using web search, Shodan, or by browsing known XWiki deployments.
2. Access the restricted page: Without any authentication, navigate directly to the AdminTools.SpammedPages page URL on the target XWiki instance (e.g., https://<target>/xwiki/bin/view/AdminTools/SpammedPages).
3. Observe access: Confirm that the page loads without triggering an access-denied error, verifying the misconfigured permissions.
4. Information gathering: Review any content rendered on the page for administrative metadata or instance configuration details that may aid further reconnaissance (GHSA).

• Network: Unexpected HTTP GET requests to /xwiki/bin/view/AdminTools/SpammedPages (or equivalent path) from unauthenticated or low-privileged users in web server access logs.
• Logs: XWiki access logs showing repeated access to AdminTools.SpammedPages from external or anonymous IP addresses without a corresponding admin session token.

Upgrade the XWiki AdminTools application to version 1.1 or later, which sets proper view permissions on the AdminTools space by default (GitHub Advisory). As an immediate workaround for installations that cannot upgrade, administrators should manually set the view rights for the entire AdminTools space to be accessible only by the XWikiAdminGroup via the XWiki administration interface (GHSA). Applying the principle of least privilege to all administrative spaces is recommended as a general hardening measure.