Wiki.js CVE-2026-44224

The attacker must already hold a valid Wiki.js account with the manage:users permission - a permission commonly delegated to moderators for account administration - which is the sole prerequisite (PR:H). Exploitation is performed over the network against the standard GraphQL endpoint by calling the users.update mutation with a groups array containing the Administrators group ID (1); no user interaction, non-default configuration, or special platform is required. Limiting factors: the flaw is not reachable by anonymous or read-only users, so environments where manage:users is held only by trusted administrators face negligible added risk, and the escalation to manage:system takes effect only after the attacker re-authenticates to obtain a refreshed JWT.

The signals point to a serious but bounded, insider-oriented risk rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H) and score of 8.6 correctly capture that the outcome is total compromise (full admin) but that the attacker must already hold high privileges (PR:H) - specifically the delegated manage:users permission - so this is not an unauthenticated internet threat. SSVC agrees: exploitation is at POC stage, Automatable is 'no' (a valid privileged foothold is a prerequisite, defeating spray-and-pray automation), and Technical Impact is 'total'. EPSS is very low (0.04%, 14th percentile) and the CVE is not in CISA KEV, consistent with a vulnerability requiring a trusted-but-limited account rather than one being opportunistically exploited at scale. Net: high-priority to patch for any deployment that delegates user management to non-administrators (multi-tenant or team wikis), lower urgency where only trusted admins hold manage:users. No signals here conflict - the low EPSS and PR:H requirement are mutually consistent with an insider privilege-escalation profile.

A wiki moderator who has been delegated manage:users to reset passwords and manage accounts issues a single users.update GraphQL mutation against their own account with groups:[1], adding themselves to the Administrators group. They log out and back in; the freshly minted JWT now includes manage:system, giving them complete control of the wiki, its content, and its configuration. No exploit code is public, but the attack requires only one crafted API call and no special tooling.