{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "1.8"
              },
              {
                "fixed": "16.10.16"
              },
              {
                "introduced": "17.0.0"
              },
              {
                "fixed": "17.4.8"
              },
              {
                "introduced": "17.5.0"
              },
              {
                "fixed": "17.10.1"
              }
            ],
            "source": "CPE_RANGE"
          },
          "events": [
            {
              "introduced": "10aac24eea2647c0e044176c369755baf8c5a5f1"
            },
            {
              "fixed": "f5d882bc97f326e1a4847aace42c60fe7cba0f41"
            },
            {
              "introduced": "e84d9bd1b4c0c8219597e10acfd8fbd692416294"
            },
            {
              "fixed": "7ea92428b2dcec895366796ea6d211c01044257f"
            },
            {
              "introduced": "0f12307c8803e5abd5fe7016bd0adf0850c5f903"
            },
            {
              "fixed": "7b786a82160aed48172815cc1b7a66d46f7e5cc9"
            }
          ],
          "repo": "https://github.com/xwiki/xwiki-commons",
          "type": "GIT"
        },
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "1.8"
              },
              {
                "fixed": "16.10.16"
              },
              {
                "introduced": "17.0.0"
              },
              {
                "fixed": "17.4.8"
              },
              {
                "introduced": "17.5.0"
              },
              {
                "fixed": "17.10.1"
              }
            ],
            "source": [
              "CPE_RANGE",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "943ce46958cb17adcf82e8fa381fb36616646f0b"
            },
            {
              "fixed": "12682112b51aa67f5acafa5398193b69adf229f7"
            },
            {
              "introduced": "7edb5b7d98170ec081c7e30237971d7dfb8a4401"
            },
            {
              "fixed": "617c215853ac7649119d019d085e739f5b2b89a8"
            },
            {
              "introduced": "b85d21efede0f7c07c04c5ad5fb7610be0866096"
            },
            {
              "fixed": "a44c0b52377470cd7b597f0e920cfbc85cf043e1"
            },
            {
              "fixed": "47b568c4753a6e682b14be1ca581bdd3b25d45a7"
            }
          ],
          "repo": "https://github.com/xwiki/xwiki-platform",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-mrqg-xmgm-rc5g"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40104.json"
  },
  "details": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.",
  "id": "CVE-2026-40104",
  "modified": "2026-07-15T01:49:21.443315977Z",
  "published": "2026-04-15T00:01:58.583Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-23550"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40104.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40104"
    },
    {
      "type": "FIX",
      "url": "https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "XWiki's REST APIs can list all pages/spaces, leading to unavailability"
}