CVE-2022-41929

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

4.9 MediumFix available

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.79%Down 0.1 points since Nov 24, 2022

What each source reports

CVE List Score used 4.9

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Record: CVE-2022-41929
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2022-7198 4.9

Record: EUVD-2022-7198
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2gj2-vj98-j2qq 4.9

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Impact

It's possible for a user with only Script rights to enable or disable a user: this operation should be only doable for users with admin rights.

Patches

This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Workarounds

There is no workaround other than upgrading the wiki, but note that this only impacts users with Script rights: administrator should take care which users have such right.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at security ML

Record: GHSA-2gj2-vj98-j2qq
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 4.9

Record: CVE-2022-41929
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 4.9

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Record: CVE-2022-41929
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSVGHSA-2gj2-vj98-j2qq 4.9

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Impact

It's possible for a user with only Script rights to enable or disable a user: this operation should be only doable for users with admin rights.

Patches

This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Workarounds

There is no workaround other than upgrading the wiki, but note that this only impacts users with Script rights: administrator should take care which users have such right.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at security ML

Record: GHSA-2gj2-vj98-j2qq
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.xwiki.platform:xwiki-platform-oldcore` Maven	11.7RC1 up to 13.10.7	13.10.7
`org.xwiki.platform:xwiki-platform-oldcore` Maven	14.0.0 up to 14.4.2	14.4.2

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-41929 is a medium vulnerability (CVSS 4.9) in Xwiki, published November 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in org.xwiki.platform:xwiki-platform-oldcore 13.10.7.