CVE-2026-48048 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

What is CVE-2026-48048?

CVE-2026-48048 is a high-severity vulnerability in xwiki-platform, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

Weakness: CWE-359

Which versions are affected by CVE-2026-48048?

6 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-livetable-ui.

How do I fix CVE-2026-48048?

Upgrade org.xwiki.platform:xwiki-platform-livetable-ui to a fixed version for your release line: 17.4.9, 17.10.3 or 16.10.17.

Is CVE-2026-48048 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48048 exists.

Public exploit code: 1 Nuclei template.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rh28-mqj4-8x59.