XWiki Platform contains a missing authorization vulnerability (CWE-862) in the POST /wikis/{wikiName} API endpoint. In affected versions starting from 15.10.6 and prior to 16.10.17, 17.4.9, 17.10.3, and 18.1.0-rc-1, this API executes a XAR import operation without performing any authentication or authorization checks. This allows unauthenticated attackers to create or update documents within the targeted wiki instance. The vulnerability is addressed by patches released in versions 16.10.17, 17.4.9, 17.10.3, 18.0.1, and 18.1.0-rc-1.

Exploitation of this vulnerability allows unauthenticated attackers to create or modify wiki documents arbitrarily, potentially leading to unauthorized data manipulation, information disclosure, or disruption of wiki content integrity. The critical CVSS score (9.3) reflects the high impact on confidentiality, integrity, and availability, with no authentication or user interaction required and exploitable remotely over the network.

This vulnerability has been patched in XWiki Platform versions 16.10.17, 17.4.9, 17.10.3, 18.0.1, and 18.1.0-rc-1. Users should upgrade to one of these fixed versions or later to remediate the issue. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigations are indicated.