EUVD-2026-64176Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API exploitable by any authenticated user (PR:L, AV:N, AC:L); admin takeover yields full CIA impact with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as viewer, to admin. Exploitation requires a valid authenticated LeafWiki user account. Instances without public registration and with only trusted users are at lower practical risk. Users should update to version 0.10.1 or greater. Until a patch is available, operators should restrict account creation and ensure that only trusted users have accounts on affected LeafWiki instances. If possible, access to the user update API should be restricted to trusted users or administrators only.
AnalysisAI
Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own account role to administrator by manipulating the user update API. The flaw stems from improper privilege management (CWE-269) in the API endpoint responsible for account updates, which fails to enforce role-assignment restrictions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated LeafWiki user account on the target instance - any role (e.g., 'viewer') is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the ease and impact of exploitation - low attack complexity, no user interaction, and full CIA impact upon gaining administrative control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a low-privileged LeafWiki account (e.g., with 'viewer' role) on a target instance. They craft an authenticated API request to the user update endpoint, supplying a role value of 'admin' in the request body alongside their own account identifier. … |
| Remediation | Upgrade LeafWiki to version 0.10.1 or later, which contains the vendor-released patch addressing the improper role assignment in the user update API; see the advisory at https://github.com/perber/leafwiki/security/advisories/GHSA-jj4r-587p-r5h5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LeafWiki deployments, document current version numbers, and review administrative account additions and permission changes in system logs for evidence of exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the ser
Uncontrolled ZIP extraction in LeafWiki 0.10.0 through 0.12.0 allows any authenticated Editor or Admin to exhaust server
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScri
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today