---
cve: "CVE-2026-48048"
severity: "HIGH"
cvss: 7.5
epss: "0.7%"
vendor: "xwiki"
kev: false
exploited: false
published: "2026-08-10 16:19:47"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-31T11:33:53+01:00"
---

# CVE-2026-48048

> 7.5 HIGH · 🧪 PoC

## Beschreibung

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-08-10 21:11:09
- CNA-CVSS: **7.5** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-359** — Exposure of Private Personal Information to an Unauthorized Actor
  The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

## Angriffsmuster (CAPEC)

- [CAPEC-464 — Evercookie](https://capec.mitre.org/data/definitions/464.html) _(Severity: Medium)_
- [CAPEC-467 — Cross Site Identification](https://capec.mitre.org/data/definitions/467.html) _(Severity: Low)_
- [CAPEC-498 — Probe iOS Screenshots](https://capec.mitre.org/data/definitions/498.html)
- [CAPEC-508 — Shoulder Surfing](https://capec.mitre.org/data/definitions/508.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1606.001 — Forge Web Credentials: Web Cookies](https://attack.mitre.org/techniques/T1606/001/)

## Patch verfügbar (OSV)

- 65a53ce90d27245391dec10056b066e7eb3ace7d (Commit)
- a0c973343dbb009ef54643526df993676b0924e3 (Commit)

## BSI-Hinweise (deutsch)

- [xwiki: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1645) — _BSI-Einstufung: mittel_
  Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.

## Referenzen

- <https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rh28-mqj4-8x59>
- <https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa>
- <https://jira.xwiki.org/browse/XWIKI-23875>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-48048/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_