CVE-2025-32971 XWiki Solr script service doesn't take dropped programming right into account

What is CVE-2025-32971?

CVE-2025-32971 is a low-severity missing authorization vulnerability in Xwiki Xwiki, published on 30 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn't take dropped programming rights into account. The Solr script service that is accessible in XWiki's scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn't take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1.

Weakness: CWE-863

Which versions are affected by CVE-2025-32971?

6 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-search-solr-api. It affects 1 product.

Products include Xwiki Xwiki.

How do I fix CVE-2025-32971?

Upgrade org.xwiki.platform:xwiki-platform-search-solr-api to a fixed version for your release line: 16.4.4, 16.8.0-rc-1 or 15.10.13.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-32971 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32971 exists.

Other vulnerabilities in Xwiki Xwiki

• CVE-2025-24893 XWiki Platform Eval Injection Exploited Critical 9.8
• CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros Critical 10.0
• CVE-2024-55662 XWiki allows remote code execution through the extension sheet Critical 10.0
• CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Critical 10.0
• CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Critical 10.0

All Xwiki Xwiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-987p-r3jc-8c8v.