CVE-2025-32783: Xwiki platform messagestream Unregistered Users Can See "public" Vulnerability
MODERATECVE-2025-32783 is a MODERATE (CVSS 4.7) unregistered users can see "public" vulnerability (CWE-668: Exposure of Resource to Wrong Sphere) affecting Xwiki platform messagestream libraries in the Maven ecosystem. The issue involves unregistered users can see "public" messages from a closed wiki via notifications from a different wiki. Remediation is available in the latest vendor maintenance releases.
CVE-2025-32783 at a Glance
Security Impact
CVSS: 4.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
How to Fix CVE-2025-32783
To remediate this vulnerability, upgrade all affected Xwiki platform messagestream dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.xwiki.platform</groupId>
<artifactId>xwiki-platform-messagestream</artifactId>
<version>Latest secure release</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.xwiki.platformHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2025-32783, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.xwiki.platformAnalyze the terminal output to locate any version of Xwiki platform messagestream in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.xwiki.platform command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-668: Exposure of Resource to Wrong Sphere, where the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. In Xwiki platform messagestream, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-32783 Affected Xwiki platform messagestream Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.xwiki.platform:xwiki-platform-messagestream
|
Maven |
≥ 5.0
≤ 16.7.1
|
|
References
Frequently Asked Questions
What is CVE-2025-32783?
Which Xwiki platform messagestream versions are affected?
What version fixes CVE-2025-32783?
Is xwiki-platform-messagestream affected?
What is the CVSS score of CVE-2025-32783?
What CWE is associated with CVE-2025-32783?
How can I check Maven dependencies for CVE-2025-32783?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-42fh-pvvh-999x",
"modified" : "2025-04-17T12:39:18Z",
"published" : "2025-04-16T15:33:35Z",
"aliases" : [ "CVE-2025-32783" ],
"summary" : "Unregistered users can see \"public\" messages from a closed wiki via notifications from a different wiki",
"details" : "### Impact\n\nThis vulnerability impacts users of a subwiki of XWiki where Message Stream is enabled and use, if they configured their wiki to be closed by selecting \"Prevent unregistered users to view pages\" in the Administrations Rights. \n\nThe vulnerability is that any message sent in a subwiki to \"everyone\" is actually sent to the farm: any visitor of the main wiki will be able to see that message through the Dashboard, even if the subwiki is configured to be private.\n\n### Patches\n\nThis problem has not been patched and is not going to be patched in the future: Message Stream has been deprecated in XWiki 16.8.0RC1 and is not maintained anymore. \n\n### Workarounds\n\nMessage Stream is disabled by default, it's advised to keep it disabled from Administration > Social > Message Stream.\n\n### References\n\n * https://jira.xwiki.org/browse/XWIKI-17154",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.xwiki.platform:xwiki-platform-messagestream"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0"
}, {
"last_affected" : "16.7.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-42fh-pvvh-999x"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-32783"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/xwiki/xwiki-platform"
}, {
"type" : "WEB",
"url" : "https://jira.xwiki.org/browse/XWIKI-17154"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-668" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-04-16T15:33:35Z",
"nvd_published_at" : "2025-04-16T22:15:14Z"
}
}