CVE-2022-36093 is an authentication bypass vulnerability affecting the XWiki Platform, a widely used generic wiki platform. The vulnerability arises from improper authentication controls (CWE-287) and the use of alternate paths or channels to bypass authentication (CWE-288). Specifically, the issue involves the Web Templates feature of XWiki, where an attacker can pass a template from the distribution wizard to the 'xpart' template. This manipulation allows the creation of user accounts even when user registration is disabled and circumvents any email verification mechanisms. The vulnerability affects XWiki Platform versions from 8.0-rc-1 up to but not including 13.10.5, and versions 14.0 up to but not including 14.3-rc-1. Notably, this flaw can be exploited on private wikis, potentially granting attackers unauthorized access. Depending on the default user rights configured, attackers may gain write access to wikis that are otherwise read-only and public. The vulnerability also impacts setups using external authentication systems such as LDAP; while authentication may fail in these cases, accounts can still be created if local accounts are enabled alongside external authentication. The vulnerability was patched in versions 13.10.5 and 14.3RC1. A temporary mitigation involves replacing the vulnerable 'xpart.vm' template with a patched version without performing a full platform update. There are no known exploits in the wild at this time, but the nature of the vulnerability allows attackers to bypass authentication controls and gain unauthorized access, which can lead to unauthorized content modification or data exposure.

For European organizations using XWiki Platform, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of wiki content. Unauthorized account creation can lead to unauthorized access to sensitive internal documentation, intellectual property, or operational procedures. In private wikis, attackers may gain full access, potentially exposing confidential business information or disrupting collaboration workflows. In public wikis configured as read-only, attackers could escalate privileges to gain write access, enabling them to inject malicious content, misinformation, or disrupt the integrity of publicly available information. Organizations relying on external authentication systems like LDAP may still be vulnerable if local accounts are enabled, increasing the attack surface. The impact is particularly critical for sectors that heavily rely on internal knowledge bases, such as government agencies, research institutions, and enterprises with distributed teams. The ability to bypass email verification also facilitates automated or large-scale account creation, increasing the risk of persistent unauthorized access. While no active exploits are reported, the ease of exploitation and the potential for privilege escalation make this vulnerability a serious concern for European organizations that have not yet applied patches or mitigations.

To mitigate this vulnerability, European organizations should prioritize upgrading XWiki Platform to versions 13.10.5 or later, or 14.3RC1 or later, where the issue is fully patched. If immediate upgrading is not feasible, organizations should replace the vulnerable 'xpart.vm' template with the patched version provided by the XWiki project to block the attack vector. Additionally, organizations should audit their user registration and authentication configurations, ensuring that local accounts are disabled if external authentication systems like LDAP are in use, unless absolutely necessary. Restricting default user rights to the minimum necessary can reduce the impact if unauthorized accounts are created. Monitoring wiki access logs for unusual account creation patterns or access attempts can help detect exploitation attempts early. Implementing network-level access controls to limit wiki access to trusted IP ranges, especially for private wikis, can further reduce exposure. Finally, organizations should review and tighten email verification and user registration workflows to prevent circumvention through alternate templates or channels.