| File: xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/tags/TagsResourceImpl.java:48-92 getAllTags() runs the raw HQL query:
select distinct elements(prop.list) from BaseObject as obj, DBStringListProperty as prop
where obj.className='XWiki.TagClass' and obj.id=prop.id.id and prop.id.name='tags'
with no hidden filter and no per-tag authorization. Every distinct tag value across the entire wiki is returned, including tags that only appear on pages the user cannot see. So disclosure of potential private information, customer data, etc to any guest. |
