CVE-2025-32972: XWiki Privilege Escalation Vulnerability

CVE-2025-32972 Overview

CVE-2025-32972 affects the XWiki generic wiki platform. The script API of the Leaner Style Sheets (LESS) compiler in XWiki incorrectly checks rights when calling the cache cleaning API. This allows a user with script right to clean the cache without holding programming right. The only observed impact is a slowdown in XWiki execution while caches are refilled by legitimate requests. Because exploitation requires script right, which already permits unlimited script execution, the additional risk introduced by this issue is limited. The vulnerability is tracked under [CWE-285: Improper Authorization]. Affected releases span 6.1-milestone-1 through 15.10.11, 16.0.0-rc-1 through 16.4.2, and 16.5.0-rc-1 through 16.7.x. Fixes are available in 15.10.12, 16.4.3, and 16.8.0-rc-1.

Critical Impact
An authenticated user with script right can invoke the LESS compiler cache cleaning API without programming right, causing availability degradation as caches are rebuilt.

Affected Products

XWiki Platform versions 6.1-milestone-1 through versions before 15.10.12
XWiki Platform versions 16.0.0-rc-1 through versions before 16.4.3
XWiki Platform versions 16.5.0-rc-1 through versions before 16.8.0-rc-1

Discovery Timeline

2025-04-30 - CVE-2025-32972 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32972

Vulnerability Analysis

The flaw resides in the LessCompilerScriptService component of the xwiki-platform-lesscss-script module. This script service exposes cache cleaning functionality intended to be restricted to callers holding programming right. The service performed authorization checks using an authorization provider that did not evaluate the full contextual document permissions. As a result, a caller with script right could invoke the cache cleaning entry point through Velocity or Groovy scripts and trigger a full LESS cache flush. Repeated invocation forces XWiki to recompile LESS resources on subsequent requests, adding latency and CPU load. The impact is limited to availability, and confidentiality and integrity are not affected.

Root Cause

The root cause is an improper authorization check [CWE-285] in the LESS compiler script service. The service relied on an authorization component that did not enforce the contextual programming right requirement before executing sensitive cache operations. The patch replaces the previous authorization lookup with the contextual authorization manager, ensuring the cache cleaning API verifies programming right against the current execution context.

Attack Vector

Exploitation requires network access to the XWiki instance and an authenticated account that has been granted script right on a page. The attacker embeds a call to the LESS compiler script service cache cleaning method inside a wiki page script. Rendering the page executes the call and evicts the LESS cache. Anonymous exploitation is not possible without a prior misconfiguration that grants script right to guests.

java

// Security patch excerpt: LessCompilerScriptService.java
// Switch from a static authorization provider to the contextual
// authorization manager so programming right is validated in context.

 import javax.inject.Inject;
 import javax.inject.Named;
-import javax.inject.Provider;
 import javax.inject.Singleton;

 import org.apache.commons.lang3.exception.ExceptionUtils;

Source: XWiki Platform Commit 91752122

Detection Methods for CVE-2025-32972

Indicators of Compromise

Unexpected calls to LessCompilerScriptService cache cleaning methods from wiki pages that do not hold programming right.
Recurring spikes in LESS recompilation activity or CSS regeneration entries in xwiki.log following page views by non-privileged users.
Sustained increases in response time for style-related resources without a corresponding configuration change.

Detection Strategies

Audit wiki page source for invocations of $services.lesscss cache cleaning methods and correlate them with the effective rights of the page author.
Review XWiki application logs for repeated LessCompilerScriptService cache clear operations originating from the same user or page.
Compare the installed XWiki version against the fixed releases documented in the XWiki Security Advisory GHSA-rp38-24m3-rx87.

Monitoring Recommendations

Alert on abnormal CPU utilization on the XWiki JVM correlated with cache miss volume on LESS resources.
Track the rate of LESS cache rebuild events and baseline them against normal operational patterns.
Enable authenticated access logging to identify which user sessions trigger cache cleaning calls.

How to Mitigate CVE-2025-32972

Immediate Actions Required

Upgrade XWiki to version 15.10.12, 16.4.3, or 16.8.0-rc-1 or later as documented in the vendor advisory.
Review users and groups granted script right and revoke it from accounts that do not require server-side scripting.
Inspect existing wiki pages for calls to the LESS compiler script service and remove unauthorized cache cleaning invocations.

Patch Information

The issue is fixed by commit 91752122d8782f171f8728004a57bdaefc34253e, tracked in XWiki Jira XWIKI-22462. The fix replaces the previous authorization provider in LessCompilerScriptService with the contextual authorization manager, ensuring programming right is enforced before the cache cleaning API executes.

Workarounds

Restrict script right to trusted administrators until the upgrade can be applied.
Enforce mandatory page approval workflows so new scripted content is reviewed before it is rendered.
Place a reverse proxy rule that rate-limits authenticated POST activity to wiki pages known to invoke script services.

bash

# Verify the installed XWiki version and confirm it is patched
grep -R "xwiki.version" /var/lib/xwiki/data/ 2>/dev/null
# Expected values: 15.10.12, 16.4.3, or 16.8.0-rc-1 or newer