CVE-2023-48241: XWiki Solr search API authorization bypass exposes all wiki documents

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with no authentication or interaction required and a very high EPSS score, though no KEV listing or documented exploitation yet.

What it is

XWiki Platform's Solr-based search suggestion provider, which also serves as a generic JavaScript API for search results, exposes the content of all documents across all wikis to anyone with access to it, and it is public by default. The normal right check can be bypassed by explicitly requesting Solr fields that omit the data used for the authorization check, so the flaw is an improper authorization issue rather than a memory or injection bug.

Impact

An unauthenticated attacker can read the content of every document in every wiki, including content that should be restricted by rights. Protected material such as password hashes is not exposed, but the bulk of stored wiki information is.

Attack surface

Reachable over the network through the Solr search suggestion provider / JavaScript search API, which is public by default. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.7282 (99.4th percentile), indicating substantial predicted exploitation activity. References are limited to the patch, vendor advisory and issue tracker, with no public exploit tag.

What to do

• Upgrade to XWiki 15.6RC1, 15.5.1 or 14.10.15, which fix the issue by not listing documents whose rights cannot be checked.
• If immediate upgrade is not possible, restrict network access to the Solr search suggestion provider and the JavaScript search API to trusted users only.
• Review wiki content for sensitive data that may have been exposed and rotate any credentials or secrets stored in documents.
• Monitor vendor advisory GHSA-7fqr-97j7-jgf4 and XWIKI-21138 for any updated guidance, since no workaround is documented.

Detection

• Audit Solr search API requests for explicit field lists that omit the fields used for rights checking.
• Monitor for unauthenticated or anomalous access to the search suggestion endpoint from unexpected source IPs.
• Review web and application logs for bulk document retrieval patterns consistent with enumerating all wiki content.
• Alert on access to the search API from accounts or networks that do not normally use search functionality.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.