Cache corruption allows seizing of administrator account.

under some circumstances, Document#get(String) will return a BaseObject from the underlying XWikiDocument.

$xwiki.getDocument('XWiki.Admin').get('XWiki.XWikiUsers').safeget('password').setValue('pwnd')

No need to save, just log in quick before the cache expires.

Other methods which should be reviewed (do not clone the document which might lead to cache poisining)
Document#getComments(boolean)
Document#getxWikiClass()
Document#getxWikiClasses()