Wiki.js EUVD-2026-81038

Requires an authenticated Wiki.js account with access to the GraphQL API (PR:L) and a deployment that relies on tag-based page access rules to restrict content - the bypass only matters where tag-scoped restrictions are actually configured. Exploitation is remote and needs no user interaction, but is limited to reading page METADATA (titles, descriptions, paths, tags) via the list, tree, tags, searchTags, and links resolvers; it does not expose page contents, does not modify data, and does not affect availability. Affected versions are Wiki.js through 2.5.314.

This is a genuine but low-severity information-disclosure issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, with impact limited to low confidentiality and NO integrity or availability effect - consistent with the description, which is confined to leaking restricted page METADATA (titles, descriptions, paths, tag info) rather than page bodies or credentials. Publicly available exploit code exists (geo-chen/oss writeup), which raises practical exploitability, but there is no EPSS score provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals and should not be conflated. The CWE (CWE-863, incorrect authorization) aligns with the described tag-omission authorization gap. Net: real and easy to exploit for an authenticated user, but the bounded confidentiality-only impact makes this a moderate-to-low operational priority rather than a critical one. Note the Tags field labels this 'Authentication Bypass' whereas the mechanism and CWE-863 describe an AUTHORIZATION bypass - the flaw does not defeat login, only tag-based access rules.

A low-privileged authenticated Wiki.js user (or any account able to reach the GraphQL API) issues list, tree, tags, searchTags, or links queries and receives metadata for pages that tag-based access rules were supposed to hide, enumerating restricted titles, descriptions, and paths. Public exploit/write-up code exists, lowering the skill required to reproduce it.