CVE-2026-92776: Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wiki.jsto a version that resolves this vulnerability.Fixed in 2.5.314
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has been granted access to a folder through a START or END page rule can exploit it when unrelated page paths share the allowed folder's literal prefix. The attacker does not need user interaction.
What access can an attacker gain?
The affected authorization matching can grant read and write access to unrelated pages whose paths begin or end with the same literal prefix as an authorized folder. This can bypass intended page-level access controls.
Are deployments affected by default?
The provided information identifies the issue in Wiki.js through 2.5.314, but does not state whether START or END page rules are enabled or present in the default configuration.
How can I identify potentially affected authorization rules?
Review START and END page rules that grant users access to folders, then identify unrelated page paths that share the same literal prefix without being within the intended path segment. Users assigned to those rules may have unintended read and write access to such pages.