Skip to main content

Wiki.js EUVDEUVD-2026-81038

| CVE-2026-92774 MEDIUM
Incorrect Authorization (CWE-863)
2026-09-16 VulnCheck GHSA-69p6-97m5-6vpp
Authentication Bypass Wiki Js
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network GraphQL API, low complexity, requires a low-privilege account (PR:L); impact is limited to disclosure of restricted page metadata, so C:L and I/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Sep 16, 2026 - 22:18 vuln.today
CVE Published
Sep 16, 2026 - 20:32 cve.org
MEDIUM 5.3

DescriptionCVE.org

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.

AnalysisAI

Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated Wiki.js account with access to the GraphQL API (PR:L) and a deployment that relies on tag-based page access rules to restrict content - the bypass only matters where tag-scoped restrictions are actually configured. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but low-severity information-disclosure issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch is identified in the supplied data at time of analysis; monitor the Requarks Wiki.js project and the VulnCheck/NVD advisories for a fixed release after 2.5.314 and upgrade as soon as one is available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wiki Js

View all
CVE-2026-92776 HIGH POC
8.6 Sep 16

Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one
CVE-2022-1681 HIGH POC
7.2 May 12

Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. Rated high
CVE-2026-92775 HIGH POC
7.1 Sep 16

Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions for
CVE-2021-25993 MEDIUM POC
5.4 Dec 29

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged
CVE-2021-43856 MEDIUM POC
5.4 Dec 27

Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
CVE-2021-43855 MEDIUM POC
5.4 Dec 27

Wiki.js is a wiki app built on node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
CVE-2021-21383 MEDIUM POC
5.4 Mar 18

Wiki.js an open-source wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely explo
CVE-2021-43800 HIGH
7.5 Dec 06

Wiki.js is a wiki app built on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
CVE-2020-15236 HIGH
7.5 Oct 05

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with
CVE-2022-23654 MEDIUM
6.5 Feb 22

Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, lo
CVE-2020-4052 MEDIUM
6.1 Jun 16

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. Rated medium severity (CVS
CVE-2021-43842 MEDIUM
5.4 Dec 20

Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-81038 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy