CVE-2022-36093 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

What is CVE-2022-36093?

CVE-2022-36093 is a high-severity authentication bypass vulnerability in Xwiki Xwiki, published on 8 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially giving the attacker access to the wiki. Depending on the configured default rights of users, this could also give attackers write access to an otherwise read-only public wiki. Users can also be created when an external authentication system like LDAP is configured, but authentication fails unless the authentication system supports a bypass/local accounts are enabled in addition to the external authentication system. This issue has been patched in XWiki 13.10.5 and 14.3RC1. As a workaround, one may replace `xpart.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

Weakness: CWE-288, CWE-287

Which versions are affected by CVE-2022-36093?

8 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-web and org.xwiki.platform:xwiki-platform-web-templates. It affects 1 product.

Products include Xwiki Xwiki.

How do I fix CVE-2022-36093?

Upgrade org.xwiki.platform:xwiki-platform-web to a fixed version for your release line: 14.3-rc-1 or 13.10.5.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-36093 being exploited?

There is no known exploitation of CVE-2022-36093 in the wild and no public exploit code.

Other vulnerabilities in Xwiki Xwiki

• CVE-2025-24893 XWiki Platform Eval Injection Exploited Critical 9.8
• CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros Critical 10.0
• CVE-2024-55662 XWiki allows remote code execution through the extension sheet Critical 10.0
• CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Critical 10.0
• CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Critical 10.0

All Xwiki Xwiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h5j3-5x63-p8jv.