Which versions of Wiki.js are affected by CVE-2026-92776?

Wiki.js deployments at or below version 2.5.314 are exposed to an access-control flaw in the page-rule engine that lets users with folder-level access reach content outside their authorized area -…

Is there a public PoC exploit available for CVE-2026-92776?

Yes, a public proof-of-concept exploit is available for CVE-2026-92776. Prioritise patching immediately.

How to fix or mitigate CVE-2026-92776?

Within 24 hours, inventory all Wiki.js instances and confirm which are running version 2.5.314 or earlier, then audit every existing folder-level permission grant and rename or restructure folders whose names form literal prefixes of other folders (for example '/docs' alongside '/docs-internal' or '/docs-private') so no path is a prefix of a restricted one; where renaming is not immediately possible, temporarily revoke folder grants that sit next to sensitive prefixes and notify affected content owners. Within 7 days, isolate sensitive documentation into a separate Wiki.js instance or separate top-level path namespace with non-overlapping naming, restrict the Wiki.js interface to trusted networks or VPN, apply rate limiting and monitoring for unusual page-read patterns across users, and subscribe to the Wiki.js project and vendor advisory channels for a fixed release. Within 30 days, complete migration of sensitive content to the isolated namespace, deploy compensating access controls (reverse-proxy authorization rules, WAF signatures blocking traversal-style path requests), rehearse restoration of the wiki from a verified clean backup, and upgrade to a vendor-released fixed version as soon as one is published, revalidating folder permissions after any upgrade.

Wiki.js CVE-2026-92776

Q: What is the CVSS score of CVE-2026-92776?

CVE-2026-92776 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-81040 HIGH

Incorrect Authorization (CWE-863)

2026-09-16 VulnCheck

GHSA-mxgr-89mh-cjg6

Authentication Bypass Wiki Js JavaScript

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable web app, low complexity, but requires a low-privilege authenticated account with a folder grant (PR:L); grants unauthorized read and write (C:H/I:H) with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 22:40 vuln.today

tag: JavaScript added

Analysis Generated

Sep 16, 2026 - 21:57 vuln.today

CVE Published

Sep 16, 2026 - 20:32 cve.org

HIGH 8.6

DescriptionCVE.org

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.

AnalysisAI

Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one folder to read and modify unrelated pages whose paths share a literal prefix with that folder (for example, access to '/docs' also exposes '/docs-internal'). The flaw lies in the START/END page-rule engine, which matches path prefixes without requiring a path-segment boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a valid authenticated Wiki.js account (PR:L) that has been granted access to at least one folder via a page permission rule; the target unauthorized pages must share a literal path prefix with an authorized folder path (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine authorization bypass (CWE-863) with meaningful risk despite requiring authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is identified in the available data; monitor the Wiki.js repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-path-prefix-matching-authorization-bypass) for an official fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Wiki.js instances and confirm which are running version 2.5.314 or earlier, then audit every existing folder-level permission grant and rename or restructure folders whose names form literal prefixes of other folders (for example '/docs' alongside '/docs-internal' or '/docs-private') so no path is a prefix of a restricted one; where renaming is not immediately possible, temporarily revoke folder grants that sit next to sensitive prefixes and notify affected content owners. …

Threat intelligence, references, and detailed analysis are available after sign-in.