A vulnerability was found in xwiki xwiki-platform, xwiki-platform-legacy-oldcore and xwiki-platform-oldcore up to 17.4.7/17.10.0. It has been declared as problematic. The impacted element is an unknown function of the component Velocity Scripting API. Such manipulation leads to missing authorization.
This vulnerability is traded as CVE-2026-33229. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
