CVE-2023-26476

Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

7.5 HighFix available

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.24%Up 1.3 points since Mar 3, 2023

What each source reports

CVE List Score used 7.5

Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

Record: CVE-2023-26476
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2023-0882 7.5

Record: EUVD-2023-0882
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5cf8-vrr8-8hjm 7.5

XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor

Impact

Users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros.

Patches

The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.

Workarounds

The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Record: GHSA-5cf8-vrr8-8hjm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-307
Updated: 2026-11-02

NVD 7.5

Record: CVE-2023-26476
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-307
Updated: 2026-11-02

OSV 7.5

Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

Record: CVE-2023-26476
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-5cf8-vrr8-8hjm 7.5

XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor

Impact

Users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros.

Patches

The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.

Workarounds

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Record: GHSA-5cf8-vrr8-8hjm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-307
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.xwiki.platform:xwiki-platform-livetable-ui` Maven	3.2-m3 up to 13.4.4	13.4.4
`org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki` Maven	3.2-m3 up to 13.4.4	13.4.4
`org.xwiki.platform:xwiki-platform-livetable-ui` Maven	13.5.0 up to 13.10.9	13.10.9
`org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki` Maven	13.5.0 up to 13.10.9	13.10.9
`org.xwiki.platform:xwiki-platform-livetable-ui` Maven	14.0.0 up to 14.7-rc-1	14.7-rc-1
`org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki` Maven	14.0.0 up to 14.7-rc-1	14.7-rc-1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26476 is a high vulnerability (CVSS 7.5) in Xwiki, published March 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 83rd percentile. Fixed in org.xwiki.platform:xwiki-platform-livetable-ui 13.4.4.