CVE-2026-53966 is a missing authorization vulnerability (CWE-862) in the XWiki Platform's Live Data edit REST API. From versions 13.4-rc-1 up to but not including 16.10.17, and in certain release candidates and versions in the 17.x and 18.x series, a user with permission to edit a page can modify that page's rights without triggering the normal document-saving authorization checks. This allows the user to grant themselves script rights, enabling execution of potentially dangerous Velocity scripts or injection of unfiltered HTML and JavaScript to clients. Additionally, the missing checks circumvent extension security controls implemented as listeners for UserUpdatingDocumentEvent and related user document events. The vulnerability is fixed in versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1.

An attacker with edit permissions on a page can escalate privileges by changing page rights without authorization, potentially executing arbitrary scripts and injecting malicious content. This can lead to client-side attacks and bypass of security controls tied to user document events. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1.

This vulnerability is fixed in XWiki Platform versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1. Users should upgrade to these or later versions to remediate the issue. No vendor advisory indicates alternative mitigations or that no action is required.