XWiki view file macro: User can view content of office file without view rights on the attachment
A user with no view rights on a page may see the content of an office attachment displayed with the view file macro.
Advisories for Maven/Com.xwiki.pro/Xwiki-Pro-Macros-Ui package
2025