CVE-2023-26475: XWiki Platform annotation displayer privilege escalation to author rights

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with low privileges and no user interaction, plus very high EPSS and public exploit references, make this a high-priority privilege escalation despite no KEV listing.

What it is

The XWiki Platform annotation displayer fails to execute annotation content in a restricted context, so annotating a document runs code with the rights of that document's author. Any user who can annotate a document can therefore act with the author's privileges, which is a serious privilege escalation in a multi-author wiki.

Impact

An attacker gains the privileges of the author of any document they can annotate, enabling code execution and data modification under that author's identity. This can lead to full compromise of documents and content owned by higher-privileged authors.

Attack surface

Reached over the network through the annotation feature; the CVSS vector shows low privileges required (PR:L) and no user interaction (UI:N), so any authenticated user able to annotate a document can trigger it.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.63587, 99.177th percentile) and vendor advisories and issue trackers are tagged Exploit, indicating public exploit information exists.

What to do

• Upgrade to XWiki 13.10.11, 14.4.7, or 14.10 as patched by the vendor.
• If immediate upgrade is not possible, restrict annotation rights to trusted users only.
• Review and reduce the privileges of document authors where feasible.
• Monitor vendor advisories and issue trackers for further guidance since no easy workaround exists.

Detection

• Audit annotation creation events and correlate with subsequent document changes or code execution by the document author.
• Monitor for unexpected content changes or script execution in documents shortly after annotation activity.
• Review logs for annotation actions performed by low-privileged users on documents owned by higher-privileged authors.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.