Security advisory
### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org)
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-32732
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:24 UTC · Revision 1
Source evidence
### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org)
osv:CVE-2021-32732
Complete source record
{
"id": "0d826f789defe690854133f57c2b7e219b057b22f7aea5ce2d789ae98c0f3b45",
"url": "https://osv.dev/vulnerability/CVE-2021-32732",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-32732",
"summary": "### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org)",
"evidence": "osv:CVE-2021-32732",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-32732",
"aliases": [
"CVE-2021-32732",
"GHSA-vh5c-jqfg-mhrh"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-commons",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "45cb44af6bd0775156a54e0a7e10804eb1689f5b"
},
{
"introduced": "271203deeb757a7c21e3c0623b79e7b3050c2a05"
},
{
"last_affected": "1d2a35bb2773fe8b68f16a65c440beb65b3a49bf"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "12.10.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:13.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0"
},
{
"last_affected": "13.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*",
"range": [
{
"introduced": "13.1-NA"
},
{
"last_affected": "13.1-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"13.0",
"13.1-NA",
"xwiki-commons-13.1",
"xwiki-commons-13.1-rc-1",
"xwiki-commons-12.10.4",
"xwiki-commons-12.10.3",
"xwiki-commons-12.10.2",
"xwiki-commons-12.10.1",
"xwiki-commons-12.10",
"xwiki-commons-8.3-milestone-2",
"xwiki-commons-8.3-milestone-1",
"xwiki-commons-8.2-milestone-2",
"xwiki-commons-8.2-milestone-1",
"xwiki-commons-8.1-milestone-2",
"xwiki-commons-8.1-milestone-1",
"xwiki-commons-8.0-milestone-2",
"xwiki-commons-8.0-milestone-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32732.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-platform",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "648a3522f7213ef0973ffc1ecc19f3237ace437e"
},
{
"introduced": "909c4bf9b308cf9cab52bfed54adccd04bad5803"
},
{
"last_affected": "5e8b9d45b1a37ab1db65cd54e915960db993c6f2"
},
{
"fixed": "69548c0320cbd772540cf4668743e69f879812cf"
},
{
"fixed": "f0440dfcbba705e03f7565cd88893dde57ca3fa8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "12.10.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:13.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0"
},
{
"last_affected": "13.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*",
"range": [
{
"introduced": "13.1-NA"
},
{
"last_affected": "13.1-NA"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "69548c0320cbd772540cf4668743e69f879812cf"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f0440dfcbba705e03f7565cd88893dde57ca3fa8"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"13.0",
"13.1-NA",
"xwiki-platform-13.1",
"xwiki-platform-13.1-rc-1",
"xwiki-platform-12.10.4",
"xwiki-platform-12.10.3",
"xwiki-platform-12.10.2",
"xwiki-platform-12.10.1",
"xwiki-platform-12.10",
"xwiki-platform-9.9-rc-2",
"xwiki-platform-8.3-milestone-1",
"xwiki-platform-8.2-milestone-2",
"xwiki-platform-8.2-milestone-1",
"xwiki-platform-8.1-milestone-2",
"xwiki-platform-8.1-milestone-1",
"xwiki-platform-8.0-milestone-2",
"xwiki-platform-8.0-milestone-1",
"xwiki-platform-7.4-milestone-2",
"xwiki-platform-7.4-milestone-1",
"xwiki-platform-7.3-milestone-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32732.json",
"vanir_signatures": [
{
"id": "CVE-2021-32732-09f5bee2",
"digest": {
"length": 813,
"function_hash": "321511329396376669312218935850776368126"
},
"source": "https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
"target": {
"file": "xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java",
"function": "retrieveUsername"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-32732-11403701",
"digest": {
"threshold": 0.9,
"line_hashes": [
"251217306514859619729184700471186833448",
"199229846389208028956009798926644344764",
"213871815080359841772049817996547587366",
"25879533808186726883246047470144874219",
"62421165840151599138911258022246008760",
"129694273408657017414493921345509943975",
"337925841246286738380181249167885145737",
"17579833428035848139847490700510753504",
"270426981502098446807195555461356081428",
"95988757209306918649795552561013156578",
"197116577369363535185915315576975665036"
]
},
"source": "https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
"target": {
"file": "xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/src/main/java/org/xwiki/administration/test/po/ForgotUsernameCompletePage.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-32732-589deacc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"212167843153462203918438076222652165542",
"267833405704134173463587126576270611872",
"122256918115292340730976151278462974449",
"253386088988216724541881939744350321869",
"168528726115801181141102509399456729119",
"229391438677786712981967939327372002714",
"213961176082885187054766903672163231412",
"187913529817686961733626460741875455451",
"208974072341044210503438707672625612527",
"191495375154641226014560563177148135448",
"96747196774251497656021484790891097701",
"121974007087520156669634355298007897279",
"311733091909938625917041651662709887816",
"75532339610968220336271361325290414112",
"4963411913489212483806052763792358310",
"27291694393317981520669052303345432939",
"214383342098226394618605417062846361939",
"260104887367736406406670934597730531264",
"281505545462669323924397718938086921186",
"237035295654585754746416190870919168424",
"165856873151530329563790312359313904346",
"318011033276162379696597374478739197271",
"283648711470615106526451807124100147789",
"174308907012048630077348165258308703677",
"260774348310256504927679534918071333626",
"80363895206049832292556761768904242199",
"265916118567180192575691118640530936087",
"46233985816664113650682750722701477674",
"187012145170103017417385982936492599583",
"108068986776790943876678393078647506132",
"161812367812486087699225520824310043052",
"326766680069370402729348557990253355991",
"91079803178060339117565205667241073202",
"273010000897075825769552332254042653601",
"94568887412941441782799840804991332966"
]
},
"source": "https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
"target": {
"file": "xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:21:14Z"
}
}
],
"modified": "2026-10-24T14:21:14.206074875Z",
"provider": "osv",
"references": [
"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vh5c-jqfg-mhrh",
"https://github.com/xwiki/xwiki-platform/commit/69548c0320cbd772540cf4668743e69f879812cf",
"https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
"https://jira.xwiki.org/browse/XWIKI-18384",
"https://jira.xwiki.org/browse/XWIKI-18408"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-32732",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443586,
"published_at": "2022-02-04T23:15:11.547+00:00"
}