# CVE-2026-48048: XWiki Platform - Credentials Disclosure

> Live exploitation tracking for CVE-2026-48048 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-48048

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** XWiki Platform
- **Weaknesses:** CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor)
- **Tags:** wiki

## Description

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

## CrowdSec analysis

[CVE-2026-48048](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-48048) is a credential disclosure vulnerability in XWiki Platform caused by an incomplete fix to an earlier flaw. By sending specially modified `LiveTableResults` requests, attackers can recover a user’s password hash and salt bit by bit in as few as 768 requests, potentially supporting offline password cracking; affected versions range from 6.2.1 to releases before the patched versions 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-48048 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target XWiki’s `/xwiki/bin/get/XWiki/LiveTableResults` or `/bin/get/XWiki/LiveTableResults` endpoint with crafted `password_class`, `collist`, and `password` parameters to disclose password hashes. Repeated requests can reveal the hash and salt bit by bit.

## Timeline

- 2026-08-10: CVE Published. CVE-2026-48048 is published to NVD.
- 2026-10-29: Rule Released. CrowdSec releases a rule to detect CVE-2026-48048 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa
- https://jira.xwiki.org/browse/XWIKI-23875
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rh28-mqj4-8x59
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48048.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-48048) follows observed exploitation activity for CVE-2026-48048. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.