CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability

April 14, 2026 (updated April 24, 2026)

REST API endpoints like /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

References

github.com/advisories/GHSA-mrqg-xmgm-rc5g
github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7
github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g
jira.xwiki.org/browse/XWIKI-23550
nvd.nist.gov/vuln/detail/CVE-2026-40104

Code Behaviors & Features

Detect and mitigate CVE-2026-40104 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →