CVE-2026-2861: Foswiki Information Disclosure Flaw

CVE-2026-2861 Overview

An information disclosure vulnerability has been identified in Foswiki versions up to 2.1.10. The vulnerability exists in the Changes/Viewfile/Oops component, where improper access control allows unauthorized users to potentially access sensitive information. This vulnerability can be exploited remotely without authentication, making it a significant concern for organizations using affected Foswiki installations.

Critical Impact

Remote attackers can exploit this vulnerability to disclose sensitive information from Foswiki installations without requiring authentication, potentially exposing confidential wiki content.

Affected Products

• Foswiki versions up to 2.1.10
• Foswiki installations with exposed Changes/Viewfile/Oops components

Discovery Timeline

• 2026-02-21 - CVE-2026-2861 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-2861

Vulnerability Analysis

This vulnerability is classified as an Information Disclosure issue (CWE-200) affecting the Foswiki wiki platform. The flaw resides in the Changes, Viewfile, and Oops handlers within Foswiki's core functionality. The root issue stems from missing access control checks that should verify whether a user has permission to view content before rendering it.

The attack can be launched remotely over the network without requiring any user interaction or authentication. An attacker can potentially access information they should not be authorized to view, including changes to wiki pages and potentially sensitive content within the Foswiki installation.

Root Cause

The vulnerability stems from insufficient access control validation in the Foswiki::UI::Changes module. Prior to the patch, the Changes functionality did not properly verify that the requesting user had VIEW permission on the topic before displaying change information. This allowed unauthenticated or low-privileged users to access change logs and potentially sensitive metadata for topics they should not have access to.

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker can directly access the vulnerable endpoints (Changes, Viewfile, or Oops handlers) without requiring authentication or user interaction. The exploit is publicly available, increasing the risk of active exploitation in the wild.

The security patch addresses this by adding proper access control checks before rendering content:

# Security patch in core/lib/Foswiki/UI/Changes.pm - Item13883: removed changes and preview
 
     Foswiki::UI::checkWebExists( $session, $webObject->web, 'find changes in' );
 
+    my $topicObject =
+      Foswiki::Meta->load( $session, $session->{webName},
+        $session->{topicName} );
+    Foswiki::UI::checkAccess( $session, 'VIEW', $topicObject );
+
     my ( $page, $eachChange, $after ) = split( /%REPEAT%/, $text );

Source: GitHub Foswiki Commit

Additionally, the patch removes the direct registration of the changes handler from the SwitchBoard:

# Security patch in core/lib/Foswiki/UI.pm - Item13883: removed changes and preview
         function => 'attach',
         context  => { attach => 1 },
     };
-    $Foswiki::cfg{SwitchBoard}{changes} = {
-        package  => 'Foswiki::UI::Changes',
-        function => 'changes',
-        context  => { changes => 1 },
-    };
     $Foswiki::cfg{SwitchBoard}{configure} = {
         package  => 'Foswiki::UI::Configure',
         function => 'configure',

Source: GitHub Foswiki Commit

Detection Methods for CVE-2026-2861

Indicators of Compromise

• Unusual access patterns to /bin/changes, /bin/viewfile, or /bin/oops endpoints
• Requests to these endpoints from unauthenticated sessions or users without proper permissions
• Spike in requests attempting to enumerate wiki topics through the changes functionality
• Web server logs showing repeated access to change history for restricted topics

Detection Strategies

• Monitor web server access logs for requests to vulnerable endpoints (/bin/changes, /bin/viewfile, /bin/oops)
• Implement web application firewall (WAF) rules to detect and alert on suspicious access patterns to Foswiki endpoints
• Review Foswiki audit logs for unauthorized access attempts to restricted content
• Deploy intrusion detection systems (IDS) with signatures for Foswiki exploitation attempts

Monitoring Recommendations

• Enable detailed logging in Foswiki to capture access attempts to sensitive endpoints
• Set up alerts for failed access control checks in Foswiki logs
• Monitor for reconnaissance activity targeting wiki structure enumeration
• Implement real-time monitoring for unusual traffic patterns to Foswiki installations

How to Mitigate CVE-2026-2861

Immediate Actions Required

• Upgrade Foswiki to version 2.1.11 or later immediately
• Review access logs for evidence of exploitation attempts prior to patching
• Audit Foswiki access control configurations to ensure proper topic restrictions
• Consider temporarily restricting access to the vulnerable endpoints until patching is complete

Patch Information

The vulnerability has been addressed in Foswiki version 2.1.11. The fix is identified by commit hash 31aeecb58b64/d8ed86b10e46 in the Foswiki distribution repository. The patch adds proper VIEW access checks in the Changes module and removes the direct SwitchBoard registration for the changes handler.

For additional details, refer to:

• Foswiki Task Item #15600
• Foswiki Task Item #15601
• GitHub Foswiki Commit

Workarounds

• Restrict network access to Foswiki installations using firewall rules until patching is possible
• Implement web application firewall (WAF) rules to block direct access to /bin/changes, /bin/viewfile, and /bin/oops endpoints
• Use reverse proxy configuration to add authentication requirements for sensitive endpoints
• Disable the changes feature at the server level if not required for your deployment

# Example Apache configuration to restrict access to vulnerable endpoints
<LocationMatch "^/bin/(changes|viewfile|oops)">
    Require valid-user
    # Or restrict by IP
    # Require ip 10.0.0.0/8 192.168.0.0/16
</LocationMatch>