CVE-2026-53527: LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update
LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as viewer, to admin. Exploitation requires a valid authenticated LeafWiki user account. Instances without public registration and with only trusted users are at lower practical risk. Users should update to version 0.10.1 or greater. Until a patch is available, operators should restrict account creation and ensure that only trusted users have accounts on affected LeafWiki instances. If possible, access to the user update API should be restricted to trusted users or administrators only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LeafWikito a version that resolves this vulnerability.Fixed in 0.10.1 - Configuration
Until a patch is available, restrict account creation so only trusted users have accounts on affected LeafWiki instances (instances without public registration are at lower practical risk).
LeafWiki account creation/registration = restricted to trusted users - Compensating control
Restrict access to the user update API to trusted users or administrators only (only trusted users have accounts / no public registration reduces practical risk).
Event History
Frequently Asked Questions
Which deployments are at greatest practical risk?
Affected instances that allow public registration are at greater risk because any newly registered user can authenticate and attempt to change their own role. Instances with registration disabled and only trusted accounts have lower practical risk.
What does an attacker need to exploit this issue?
The attacker needs a valid authenticated LeafWiki user account. No user interaction is required after authentication.
How can I mitigate the issue before upgrading?
Restrict account creation and ensure that only trusted users have accounts on affected instances. If possible, restrict access to the user update API to trusted users or administrators only.
How can I check whether an instance is affected?
LeafWiki versions 0.1.0 through 0.10.0 are affected. Upgrade to version 0.10.1 or later.