CVE-2025-54990: XWiki AdminTools Auth Bypass Vulnerability

CVE-2025-54990 Overview

CVE-2025-54990 is an improper access control vulnerability in the XWiki AdminTools application. The AdminTools extension integrates administrative utilities for managing a running XWiki instance. Prior to version 1.1, the AdminTools.SpammedPages page grants view rights to non-administrative users. While no sensitive data renders for unauthorized users, the page itself remains accessible outside the intended administrator boundary. The issue is categorized under [CWE-276] Incorrect Default Permissions. Maintainers patched the flaw in version 1.1 of the AdminTools application.

Critical Impact
Unauthenticated network-based access to an administrative page that should be restricted to members of XWikiAdminGroup, breaking the intended authorization model.

Affected Products

XWiki AdminTools application versions prior to 1.1
XWiki instances with the AdminTools extension installed
Deployments relying on default AdminTools space permissions

Discovery Timeline

2025-11-18 - CVE-2025-54990 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54990

Vulnerability Analysis

The AdminTools application ships with an administrative page named AdminTools.SpammedPages. This page is designed to help administrators identify and manage pages flagged as spam within an XWiki instance. In versions prior to 1.1, the view rights on AdminTools.SpammedPages are not constrained to the XWikiAdminGroup. Any authenticated or unauthenticated user with network reach to the XWiki instance can request the page URL and receive an HTTP 200 response.

The underlying issue is a permissions misconfiguration rather than a data exposure defect. The rendered output does not include the spam page listings for non-administrators. However, the existence and reachability of the administrative endpoint constitute a violation of the access control policy. Attackers can use this reachability to fingerprint the AdminTools installation and confirm the presence of administrative surface area on the target instance.

Root Cause

The root cause is incorrect default permissions [CWE-276] on the AdminTools space. The bundled page definition does not restrict the view right to XWikiAdminGroup, so the global default (typically view for all users) applies. This design defect exposes the administrative page rather than a coding flaw in request handling.

Attack Vector

An attacker sends an HTTP GET request to the AdminTools.SpammedPages URL on a vulnerable XWiki instance. The request requires no authentication, no user interaction, and low complexity. The response confirms the page exists, providing reconnaissance value even without disclosing spam data. No verified public exploit code is available. See the GitHub Security Advisory for maintainer analysis.

Detection Methods for CVE-2025-54990

Indicators of Compromise

Anonymous or non-admin HTTP GET requests to /xwiki/bin/view/AdminTools/SpammedPages returning HTTP 200
Requests to the AdminTools space originating from user accounts that are not members of XWikiAdminGroup
Repeated enumeration of AdminTools.* paths from a single source IP

Detection Strategies

Parse XWiki access logs for requests to any resource under the AdminTools space and correlate against the authenticated user's group membership
Alert when the response code for AdminTools.SpammedPages is 200 for a non-admin session identifier
Deploy web application firewall (WAF) rules that flag unauthenticated access to /bin/view/AdminTools/ paths

Monitoring Recommendations

Enable verbose access logging on the XWiki servlet container and forward logs to a central analytics platform
Track the installed AdminTools extension version through the XWiki Extension Manager audit log
Review permission changes on the AdminTools space on a scheduled cadence

How to Mitigate CVE-2025-54990

Immediate Actions Required

Upgrade the XWiki AdminTools application to version 1.1 or later using the Extension Manager
Audit the current view rights on the AdminTools space and confirm they are limited to XWikiAdminGroup
Review recent access logs for unauthorized requests to AdminTools.SpammedPages

Patch Information

The maintainers released XWiki AdminTools version 1.1, which restricts view rights on AdminTools.SpammedPages to administrators. Administrators should install the update through the XWiki Extension Manager or by deploying the updated XAR package. Refer to the GitHub Security Advisory GHSA-v7r8-8p5c-h4xw for release details.

Workarounds

Manually configure the AdminTools space rights so that the view right is granted only to XWikiAdminGroup until the upgrade is applied
Restrict network access to XWiki administrative paths through a reverse proxy or WAF rule
Remove the AdminTools extension if it is not required for daily operations

bash

# Configuration example: set AdminTools space view rights to XWikiAdminGroup only
# Navigate to: AdminTools space > Administer Space > Rights
# Then apply an equivalent of the following object via the REST API:
#   className: XWiki.XWikiGlobalRights
#   groups:    XWiki.XWikiAdminGroup
#   levels:    view
#   allow:     1
curl -u admin:password \
  -X POST \
  -H "Content-Type: application/xml" \
  --data-binary @admintools-rights.xml \
  https://xwiki.example.com/xwiki/rest/wikis/xwiki/spaces/AdminTools/pages/WebPreferences/objects