{"id":"CVE-2022-41930","aliases":["GHSA-p5v9-g8w8-5q4v"],"url":"https://o3.security/vulnerability/CVE-2022-41930","summary":"org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users","details":"org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.","published":"2022-11-23T00:00:00Z","modified":"2026-08-12T03:51:42.306175715Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-user-profile-ui","fixedVersion":"13.10.7"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-user-profile-ui","fixedVersion":"14.4.2"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa","label":"xwiki/xwiki-platform@5be1cc0"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19792"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41930.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5v9-g8w8-5q4v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41930"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.306175715Z"}}