CVE-2023-50719: XWiki Solr search exposes user password hashes and stored secrets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable disclosure of all users' password hashes and plaintext secrets, with very high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

XWiki's Solr-based search returns sensitive data, including password hashes for all users, to anyone who can view the relevant user profiles. Because user profiles are public by default, this exposes credential material and any extension-stored secrets such as API keys in plain text. The flaw affects XWiki from 7.2-milestone-2 up to the fixed versions 14.10.15, 15.5.2 and 15.7-rc-1.

Impact

An unauthenticated remote attacker can harvest password hashes for all users and read plaintext secrets such as API keys held in extension configurations. The hashes can be cracked offline to recover credentials, and the exposed keys can be used to reach connected systems.

Attack surface

Reachable over the network through the Solr-based search interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any deployment where user profiles are publicly viewable, which is the default, is exposed.

Exploitation

No CISA KEV listing and no ransomware usage are recorded, but EPSS is very high at 0.835 (99.7th percentile), indicating a strong likelihood of attempted exploitation. References are patch and vendor advisory only, with no public exploit tag.

What to do

• Upgrade to XWiki 14.10.15, 15.5.2 or 15.7-rc-1 or later; no workaround exists.
• Restrict view rights on user profiles so they are not publicly readable.
• Rotate all credentials and API keys stored in XWiki extension configurations after patching.
• Force password resets for affected accounts, since hashes may have been disclosed.
• Audit Solr search exposure and limit search access to trusted users.

Detection

• Search XWiki and web server logs for Solr search queries returning user profile or configuration content to unauthenticated clients.
• Monitor for bulk or automated queries against the Solr search endpoint from single source IPs.
• Alert on access to user profile pages by unauthenticated sessions where profiles should be restricted.
• Review outbound authentication attempts using XWiki-stored API keys for signs of reuse after exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.