CVE-2026-37106: DokuWiki Auth Bypass Vulnerability

CVE-2026-37106 Overview

CVE-2026-37106 describes an issue in DokuWiki 2025-05-14b "Librarian" 56.2 where a remote attacker can create an account through the register function in inc/auth.php. The vendor disputes this report because self-registration is intentional behavior when the product is explicitly configured to allow it. Self-registration is a non-default feature and requires administrator opt-in. The issue is classified under CWE-640: Weak Password Recovery Mechanism for Forgotten Password.

Critical Impact
A remote, unauthenticated user can create accounts on DokuWiki instances where self-registration has been explicitly enabled by an administrator. The vendor considers this working as designed.

Affected Products

DokuWiki 2025-05-14b "Librarian" 56.2
DokuWiki instances configured with self-registration enabled
Deployments using the default inc/auth.php authentication handler

Discovery Timeline

2026-06-30 - CVE-2026-37106 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-37106

Vulnerability Analysis

The report targets the register function in DokuWiki's inc/auth.php file. This function is the standard entry point for user self-registration in the platform. When self-registration is enabled, unauthenticated network clients can submit registration requests and obtain valid accounts. The reporter classified this behavior as a security issue allowing unauthenticated account creation.

DokuWiki maintainers dispute the classification. In their response on DokuWiki Issue #4682, they state that self-registration is a documented, optional feature that administrators must explicitly enable through configuration. The default DokuWiki installation ships with self-registration disabled, so out-of-the-box deployments are not exposed.

While the CVE remains published, defenders should treat it as a configuration hardening item rather than a code-level flaw. The exploit prediction score from EPSS remains low, reflecting the disputed status and the requirement for a non-default configuration.

Root Cause

The underlying mechanism is DokuWiki's self-registration workflow, which by design accepts registration submissions from anonymous visitors when the disableactions configuration does not include register. No authentication, invitation token, or administrator approval step is enforced by default in this workflow.

Attack Vector

An attacker sends an HTTP POST request to the DokuWiki registration endpoint with a chosen username, email address, and full name. If self-registration is enabled, the server creates the account and issues credentials. Proof-of-concept steps are documented in the public GitHub Gist.

The vulnerability manifests only when administrators intentionally allow public sign-up. See the DokuWiki repository for the reference implementation of inc/auth.php.

Detection Methods for CVE-2026-37106

Indicators of Compromise

Bursts of HTTP POST requests to /doku.php with do=register parameters from a single source
New user entries appearing in conf/users.auth.php outside of expected onboarding windows
Registration confirmation emails sent to disposable or throwaway email domains
Newly created accounts immediately attempting to edit or read restricted namespaces

Detection Strategies

Review DokuWiki access logs for the do=register action and correlate with source IP reputation data
Baseline the normal rate of new account creations and alert on deviations
Monitor changes to the users.auth.php file for unexpected additions

Monitoring Recommendations

Forward DokuWiki web server logs to a centralized logging platform for retention and query
Alert on registration events originating from anonymization networks or hosting provider ranges
Track first-action-after-registration behavior to identify automated abuse

How to Mitigate CVE-2026-37106

Immediate Actions Required

Verify whether self-registration is enabled in your DokuWiki configuration and disable it if not required
Add register to the disableactions configuration directive to remove the registration endpoint
Audit existing accounts and remove any that were created without a legitimate business need
Where public sign-up is required, place the DokuWiki instance behind a reverse proxy with CAPTCHA or rate limiting

Patch Information

The vendor has not released a patch because the reported behavior is considered intentional. Refer to DokuWiki Issue #4682 for the vendor position. Administrators who require self-registration should rely on configuration controls and supplementary access management.

Workarounds

Disable self-registration by setting $conf['disableactions'] to include register in local.php
Restrict access to the DokuWiki instance to authenticated corporate identities via SSO or reverse proxy authentication
Require administrator approval for new accounts by using an auth backend such as authplain combined with manual provisioning
Deploy a web application firewall rule to block anonymous requests to the registration action

bash

# Configuration example: disable self-registration in DokuWiki local.php
$conf['disableactions'] = 'register';