CVE-2023-50720: XWiki Solr search leaks user email addresses despite obfuscation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw is trivially reachable without authentication and leaks personal data, and the very high EPSS score signals likely exploitation despite no KEV listing.

What it is

XWiki's Solr-based search indexes email address properties even when email obfuscation is enabled, so searching for `objcontent:email*` returns the addresses. This defeats the intended privacy control and exposes user contact data to anyone who can reach the search interface. Fixed in 14.10.15, 15.5.2 and 15.7-rc-1 by not indexing email properties when obfuscation is on.

Impact

An attacker obtains user email addresses that the platform was configured to hide, enabling spam, phishing and account-targeting against the user base. The exposure is limited to confidentiality; no integrity or availability impact is described.

Attack surface

Reachable over the network through XWiki's regular search interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The attacker only needs to submit a crafted search query such as `objcontent:email*`.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is 0.59119 (99th percentile), indicating a high predicted likelihood of exploitation activity. The vendor advisory and patch commits are the only references provided.

What to do

• Upgrade to XWiki 14.10.15, 15.5.2, 15.7-rc-1 or later, which stops indexing email properties when obfuscation is enabled.
• If immediate upgrade is not possible, restrict access to the search interface to trusted or authenticated users only.
• Review whether email obfuscation is actually enabled and treat any exposed addresses as compromised for phishing awareness.
• Monitor vendor advisory GHSA-2grh-gr37-2283 and Jira XWIKI-20371 for updates, since the record states there are no known workarounds.

Detection

• Search XWiki access logs for queries containing `objcontent:email` or similar email-property search patterns.
• Alert on unusual volumes of search requests from a single account or IP, especially unauthenticated ones.
• Audit Solr index contents for email address fields to confirm whether obfuscated properties are still indexed.
• Correlate search activity with subsequent outbound phishing or spam targeting the exposed addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.