CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2026-48048Public Exploit

XWiki Platform - Credentials Disclosure (CVE-2026-48048)

PublishedAug 10, 2026
First SeenN/A
Last Seen
Reported
CVSS7.5
XWiki
XWikiXWiki Platform
wiki

Description

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page XWiki.LiveTableResultsMacros.

psychologyCrowdSec Analysis

CVE-2026-48048 is a credential disclosure vulnerability in XWiki Platform caused by an incomplete fix to an earlier flaw. By sending specially modified LiveTableResults requests, attackers can recover a user’s password hash and salt bit by bit in as few as 768 requests, potentially supporting offline password cracking; affected versions range from 6.2.1 to releases before the patched versions 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-48048 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target XWiki’s /xwiki/bin/get/XWiki/LiveTableResults or /bin/get/XWiki/LiveTableResults endpoint with crafted password_class, collist, and password parameters to disclose password hashes. Repeated requests can reveal the hash and salt bit by bit.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-08-10
Rule Released2026-10-29

Related Weaknesses

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References