THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-45ph-gxxr-gwgw (high) — XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

[GHSA] GHSA-45ph-gxxr-gwgw (high) — XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

medgithub_advisoriesPublished 2026-08-19

GHSA-45ph-gxxr-gwgw Severity: high CVE: CVE-2026-53966

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

### Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to exec

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-45ph-gxxr-gwgw