CVE-2026-92776CWE-863broken-access-control

CVE-2026-92776

High · published September 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-17T01:17Z
References (5)
https://github.com/geo-chen/oss/blob/main/wiki.md#finding-3-page-permission-rule-engine-grants-readwrite-access-to-any-page-whose-path-shares-a-literal-prefix-with-an-allowed-path-no-path-segment-boundary-check · [email protected]https://github.com/requarks/wiki · [email protected]https://github.com/requarks/wiki/blob/v2.5.314/server/core/auth.js#L252-L263 · [email protected]https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-path-prefix-matching-authorization-bypass · [email protected]https://github.com/geo-chen/oss/blob/main/wiki.md#finding-3-page-permission-rule-engine-grants-readwrite-access-to-any-page-whose-path-shares-a-literal-prefix-with-an-allowed-path-no-path-segment-boundary-check · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass
    cvelistv5