CVE-2023-50720

XWiki Platform Solr search discloses email addresses of users

5.3 MediumFix available

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email* using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

59.1%Up 59.1 points since Dec 16, 2023

What each source reports

CVE List Score used 5.3

XWiki Platform Solr search discloses email addresses of users

Record: CVE-2023-50720
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2023-3073 5.3

Record: EUVD-2023-3073
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2grh-gr37-2283 5.3

Solr search discloses email addresses of users

Impact

The Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email* using XWiki's regular search interface.

Patches

This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. Further, changing the setting now triggers re-indexing of the affected wiki(s).

Workarounds

We're not aware of any workarounds.

References

Attribution

This vulnerability was reported on Intigriti by ynoof @Ynoof5.

Record: GHSA-2grh-gr37-2283
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 5.3

Record: CVE-2023-50720
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 5.3

XWiki Platform Solr search discloses email addresses of users

Record: CVE-2023-50720
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-2grh-gr37-2283 5.3

Solr search discloses email addresses of users

Impact

Patches

Workarounds

We're not aware of any workarounds.

References

Attribution

This vulnerability was reported on Intigriti by ynoof @Ynoof5.

Record: GHSA-2grh-gr37-2283
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.xwiki.platform:xwiki-platform-search-solr-api` Maven	before 14.10.15	14.10.15
`org.xwiki.platform:xwiki-platform-search-solr-api` Maven	15.0-rc-1 up to 15.5.2	15.5.2
`org.xwiki.platform:xwiki-platform-search-solr-api` Maven	15.6-rc-1 up to 15.7-rc-1	15.7-rc-1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	XWiki < 4.10.15 - Email Disclosure

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-50720 is a medium vulnerability (CVSS 5.3) in Xwiki, published December 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 59.1%, the 99th percentile. Fixed in org.xwiki.platform:xwiki-platform-search-solr-api 14.10.15.