Branch: refs/heads/cvss-impact-from-achievable Home: https://github.com/xwiki/xwiki-dev-llm Commit: a5a9971a30efec90406129f8b2de8e78a5f05a60 https://github.com/xwiki/xwiki-dev-llm/commit/a5a9971a30efec90406129f8b2de8e... Author: Simon Urli <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Clarify how to score CVSS impacts for gained rights and preconditions * A right the attack yields never caps the impacts: only a right it needs does. * Score impacts from what the attacker can achieve, not from what a PoC printed. * Check the usual wiki access setups before calling an Attack Requirement rare. * Drop a sentence restating that per-metric values are not cached. Co-Authored-By: Claude Opus 5.5 <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications