A reproducer for the frontend error-detail exposure that needs no account, no page and no configuration, measured 2026-10-07 on 18.8.0:
GET /bin/get/CKEditor/HTMLConverter?fromHTML=false&toHTML=true&sourceDocumentReference=Main.WebHome
&text={{groovy}}1{{/groovy}}&formToken=<the guest's own token from any page>
-> 200, 102,456 bytes, 3 "xwikirenderingerrordescription hidden" boxes, 310 stack frames
The converter renders text as the caller, the script macro is refused, and the refusal is rendered through XWikiErrorBlockGenerator, which exposes ExceptionUtils.getStackTrace(...) to the error template (XWikiErrorBlockGenerator.java:132). hidden is CSS only, so the full trace is in the HTML source. Control, same run: an include of a missing page as text -> 200, 4,062 bytes, no error box.
