CVE-2026-53966: 
Java vulnerability analysis and mitigation

CVE-2026-53966 is a privilege escalation vulnerability in the XWiki Platform Live Data Live Table Connector (org.xwiki.platform:xwiki-platform-livedata-livetable) that allows any authenticated user with page-edit permissions to escalate their privileges to script right via the Live Data edit REST API. The vulnerability affects versions >= 13.4-rc-1 through multiple release branches, up to but not including the patched versions. It was first published on June 11, 2026, and formally added to the GitHub Advisory Database on August 19, 2026. It carries a CVSS v4 base score of 7.1 (High) (GitHub Advisory, XWiki Advisory).

The root cause is a missing authorization check (CWE-862) in the ModelBridge.java component of the Live Data Live Table Connector. Specifically, the saveDocument method previously called xcontext.getWiki().saveDocument() without first invoking checkSavingDocument(), meaning the full suite of document-saving security checks — including those triggered by UserUpdatingDocumentEvent and similar event listeners — were bypassed entirely. An authenticated attacker with only edit rights on a page can craft a REST API request to the Live Data editing endpoint to modify the page's rights object (e.g., changing the levels field to script), thereby granting themselves script right on that page without proper authorization validation. The fix (commit 448b0f0) adds a call to xcontext.getWiki().checkSavingDocument() before saving, and also adopts the new author APIs to correctly set the document author (XWiki Advisory, Patch Commit).

Successful exploitation allows an authenticated user with only edit rights to obtain script right on a page, enabling execution of arbitrary Velocity scripts and delivery of unfiltered HTML and JavaScript to other users' browsers — effectively enabling stored XSS attacks. Additionally, security checks implemented in third-party extensions as listeners to UserUpdatingDocumentEvent and similar events are also circumvented, potentially undermining custom access control logic across the XWiki installation. The primary impact is on integrity of the vulnerable system, with no direct confidentiality or availability impact assessed by the CVSS scoring (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.038% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated account with edit access to at least one page, and no user interaction or special attack conditions are needed beyond that.

1. Obtain edit access: Log in to the target XWiki instance with any account that has edit rights on at least one page (e.g., a standard user account or a free-trial account).
2. Identify a target page: Locate a page where the attacker has edit rights and where escalating to script right would be beneficial (e.g., a page with a Velocity macro that is currently blocked due to lack of script right).
3. Locate the XWikiRights object: Use the XWiki REST API or the Live Data interface to identify the XWiki.XWikiRights object associated with the target page, noting the current levels field value (e.g., edit).
4. Craft a malicious REST API request: Send a PUT/PATCH request to the Live Data edit REST API endpoint targeting the levels property of the rights object on the page, setting the value to script. For example:

   PUT /xwiki/rest/livedata/entries/<page-ref>?...
   Body: { "levels": "script" }

5. Verify privilege escalation: Reload the target page and confirm that Velocity macros now execute successfully, indicating script right has been granted.
6. Execute malicious Velocity or JavaScript: With script right obtained, embed arbitrary Velocity code or unfiltered JavaScript in the page to exfiltrate data, perform actions on behalf of other users, or further escalate privileges within the XWiki instance (XWiki Advisory, Patch Commit).

• Network: Unexpected PUT or PATCH REST API requests to XWiki Live Data endpoints (e.g., /xwiki/rest/livedata/entries/) from low-privileged user accounts, particularly those modifying rights-related fields such as levels.
• Logs: XWiki access logs showing REST API calls to Live Data editing endpoints by users who do not normally interact with those APIs; log entries indicating document saves with LiveData update. as the comment from non-administrative users.
• Application Behavior: Pages that previously failed to render Velocity macros (due to lack of script right) suddenly rendering successfully after a Live Data REST API call; unexpected changes to XWiki.XWikiRights objects on pages.
• Audit Trail: XWiki document history showing rights modifications attributed to low-privilege users, particularly changes to the levels field of rights objects on pages those users edit.

Upgrade the XWiki Platform to one of the following patched versions: 16.10.17, 17.4.10, 17.10.4, or 18.1.0 (or later). The fix is implemented in commit 448b0f0, which adds the missing checkSavingDocument() call and corrects author handling in the Live Data ModelBridge. No workarounds are available other than upgrading — the XWiki team is not aware of any configuration-based mitigations (XWiki Advisory, Patch Commit).