Is there a public PoC exploit available for CVE-2026-92774?

Yes, a public proof-of-concept exploit is available for CVE-2026-92774. Prioritise patching immediately.

Wiki.js CVE-2026-92774

Q: What is the CVSS score of CVE-2026-92774?

CVE-2026-92774 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-81038 MEDIUM

Incorrect Authorization (CWE-863)

2026-09-16 VulnCheck

GHSA-69p6-97m5-6vpp

Authentication Bypass Wiki Js

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network GraphQL API, low complexity, requires a low-privilege account (PR:L); impact is limited to disclosure of restricted page metadata, so C:L and I/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 22:18 vuln.today

CVE Published

Sep 16, 2026 - 20:32 cve.org

MEDIUM 5.3

DescriptionCVE.org

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.

AnalysisAI

Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated Wiki.js account with access to the GraphQL API (PR:L) and a deployment that relies on tag-based page access rules to restrict content - the bypass only matters where tag-scoped restrictions are actually configured. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but low-severity information-disclosure issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch is identified in the supplied data at time of analysis; monitor the Requarks Wiki.js project and the VulnCheck/NVD advisories for a fixed release after 2.5.314 and upgrade as soon as one is available. … Detailed patch versions, workarounds, and compensating controls in full report.