CVE-2026-92776 requarks CVE debrief

Who should care

Wiki.js administrators and users with folder access should assess their exposure and verify configurations due to the authorization bypass vulnerability. They must be cautious when accessing pages with matching prefixes to avoid unintended data exposure or modification. The vulnerability allows for potential data breaches and unauthorized modifications within the Wiki.js platform.

Why it matters

Wiki.js administrators and users with folder access should assess exposure and verify configurations due to the authorization bypass vulnerability.

• Wiki.js administrators need to verify page rule configurations to prevent unauthorized access.
• Users with folder access must be cautious when accessing pages with matching prefixes to avoid unintended data exposure or modification.
• The vulnerability allows for potential data breaches and unauthorized modifications within the Wiki.js platform.

Technical summary

The vulnerability in Wiki.js through 2.5.314 allows attackers to access pages sharing a prefix with authorized folders by failing to require path separators when matching START and END page rules. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls. This issue arises from the lack of path separator requirements when matching page rules, allowing unauthorized access to pages with matching prefixes. Wiki.js administrators and users with folder access should verify their configurations and assess exposure to prevent potential data breaches and unauthorized modifications.

Defensive priority

Wiki.js administrators and users with folder access should verify their configurations and assess exposure.

Recommended defensive actions

• Wiki.js administrators should review and update their page rule configurations to ensure proper path separator requirements.
• Users with folder access should be cautious when accessing pages with matching prefixes.
• Administrators should verify the integrity of their Wiki.js installations and update to a patched version if available.
• Wiki.js administrators and users with folder access should assess their exposure and verify configurations.
• Administrators should consider compensating controls for exposed systems while remediation is scheduled and verified.
• Administrators should track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The vulnerability was reported in Wiki.js version 2.5.314. The issue arises from the lack of path separator requirements when matching page rules, allowing unauthorized access to pages with matching prefixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.