CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability

April 14, 2026 (updated April 24, 2026)

REST API endpoints like /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

References

github.com/advisories/GHSA-mrqg-xmgm-rc5g
github.com/xwiki/xwiki-platform
github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7
github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g
jira.xwiki.org/browse/XWIKI-23550
nvd.nist.gov/vuln/detail/CVE-2026-40104

Code Behaviors & Features

Detect and mitigate CVE-2026-40104 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →