CVE-2023-26056: Incorrect Authorization (CWE-863)
value: XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.4
Published: 2023-03-02T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
Commit date: 2022-09-09 13:41:29 +0200
Commit message: XWIKI-19856: Bad execution setup on the context macro

Diff: diff --git a/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java b/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
index 03ae81837dba..c01d8c452857 100644
--- a/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
+++ b/xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
@@ -168,18 +168,18 @@ public List<Block> execute(ContextMacroParameters parameters, String content, Ma
 
         // Reuse the very generic async rendering framework (even if we don't do async and caching) since it's taking
         // care of many other things
         BlockAsyncRendererConfiguration configuration = createBlockAsyncRendererConfiguration(null, xdom, context);
 
-        // Configure the Transformation Context XDOM depending on the mode asked.
-        configuration.setXDOM(getXDOM(referencedDocReference, parameters));
-
         Map<String, Object> backupObjects = new HashMap<>();
         try {
             // Switch the context document
             this.documentAccessBridge.pushDocumentInContext(backupObjects, referencedDocReference);
 
+            // Configure the Transformation Context XDOM depending on the mode asked.
+            configuration.setXDOM(getXDOM(referencedDocReference, parameters));
+
             // Execute the content
             Block result = this.executor.execute(configuration);
 
             // Keep metadata so that the result stay associated to context properties when inserted in the parent XDOM
             return Arrays.asList((Block) new MetaDataBlock(result.getChildren(), xdom.getMetaData()));

Vulnerable code:         // Configure the Transformation Context XDOM depending on the mode asked.
        configuration.setXDOM(getXDOM(referencedDocReference, parameters));

Fixed code:             // Configure the Transformation Context XDOM depending on the mode asked.
            configuration.setXDOM(getXDOM(referencedDocReference, parameters));