CVE-2026-92774CWE-863broken-access-control

CVE-2026-92774

Medium · published September 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-17T01:17Z
References (5)
https://github.com/geo-chen/oss/blob/main/wiki.md#finding-1-tag-based-page-rule-access-restrictions-bypassed-in-pageslisttreetagslinks-graphql-queries-leaking-restricted-page-metadata · [email protected]https://github.com/requarks/wiki · [email protected]https://github.com/requarks/wiki/blob/v2.5.314/server/graph/resolvers/page.js#L136-L139 · [email protected]https://github.com/requarks/wiki/blob/v2.5.314/server/graph/resolvers/page.js#L58-L62 · [email protected]https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-authorization-bypass-via-graphql-tag-omission · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission
    cvelistv5