CVE-2021-32620: XWiki users registered with email verification can self re-activate their disabled accounts

May 18, 2021 (updated January 22, 2025)

A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.

References

github.com/advisories/GHSA-76mp-659p-rw65
github.com/xwiki/xwiki-commons
github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4
github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65
jira.xwiki.org/browse/XWIKI-17942
nvd.nist.gov/vuln/detail/CVE-2021-32620

Detect and mitigate CVE-2021-32620 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →