CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability
### Impact REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis. ### Patches This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1. ### Workarounds We're not aware of any workarounds apart from upgrading the affected modules.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40104?
CVE-2026-40104 has a high severity due to its potential to exhaust resources in large wikis.
What are the affected versions for CVE-2026-40104?
CVE-2026-40104 affects versions of the XWiki platform between 17.0.0-rc-1 and 17.10.1, as well as prior versions of 16.10.16.
How do I fix CVE-2026-40104?
To fix CVE-2026-40104, you need to upgrade to XWiki versions 17.10.1, 17.4.8, or 16.10.16.
What type of vulnerability is CVE-2026-40104?
CVE-2026-40104 is a resource exhaustion vulnerability in the REST API of the XWiki platform.
Which component is vulnerable in CVE-2026-40104?
CVE-2026-40104 affects the metadata handling in the REST API endpoint `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties`.