CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability
Impact REST API endpoints like /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.
Patches This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.
Workarounds We're not aware of any workarounds apart from upgrading the affected modules.
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40104?
CVE-2026-40104 has a high severity due to its potential to exhaust resources in large wikis.
What are the affected versions for CVE-2026-40104?
CVE-2026-40104 affects versions of the XWiki platform between 17.0.0-rc-1 and 17.10.1, as well as prior versions of 16.10.16.
How do I fix CVE-2026-40104?
To fix CVE-2026-40104, you need to upgrade to XWiki versions 17.10.1, 17.4.8, or 16.10.16.
What type of vulnerability is CVE-2026-40104?
CVE-2026-40104 is a resource exhaustion vulnerability in the REST API of the XWiki platform.
Which component is vulnerable in CVE-2026-40104?
CVE-2026-40104 affects the metadata handling in the REST API endpoint `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties`.