CVE-2026-92774: Wiki.js Authentication Bypass Vulnerability

CVE-2026-92774 Overview

CVE-2026-92774 is an authorization bypass vulnerability affecting Wiki.js through version 2.5.314. The flaw resides in multiple GraphQL resolvers that omit page tags from authorization checks, allowing tag-based access restrictions to be bypassed. Attackers with low-privilege authenticated access can query the list, tree, tags, searchTags, and links resolvers to retrieve metadata for pages they should not be able to see. The disclosed metadata includes page titles, descriptions, paths, and tag information. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact

Authenticated attackers can enumerate restricted page metadata across Wiki.js instances that rely on tag-based page rules for access control, leaking organizational structure and sensitive document titles.

Affected Products

• Wiki.js versions through 2.5.314
• Deployments using tag-based page rules for access restrictions
• Self-hosted Wiki.js instances exposing GraphQL endpoints to authenticated users

Discovery Timeline

• 2026-09-16 - CVE CVE-2026-92774 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92774

Vulnerability Analysis

Wiki.js implements page-level access control through rules that can restrict content based on paths, page identifiers, or tags. Tag-based rules let administrators mark pages as restricted using specific tags and enforce authorization at query time. The affected GraphQL resolvers in server/graph/resolvers/page.js filter results using path and identifier checks but do not evaluate tag-based rules against the results. As a result, restricted pages surface through resolver responses that were expected to honor the same authorization boundary as the primary page fetch endpoint. The exposed data includes page titles, descriptions, paths, and associated tags, which can be used to map internal knowledge base structure prior to further attacks.

Root Cause

The root cause is missing tag inspection inside the authorization filter applied to the list, tree, tags, searchTags, and links resolvers. Reference implementations are visible in the Wiki.js source at server/graph/resolvers/page.js lines 58-62 and lines 136-139. Because the filters skip tag evaluation, the authorization decision is incomplete and returns metadata for pages that tag rules should have hidden.

Attack Vector

An authenticated user with baseline read privileges sends GraphQL queries to the affected resolvers. The server returns metadata for pages restricted by tag rules without enforcing the tag-based authorization check. Exploitation requires network access to the Wiki.js GraphQL endpoint and valid low-privilege credentials. Technical exploitation details are documented in the Wiki.js exploit analysis and the VulnCheck advisory.

// No verified exploit code available. See linked references for query examples
// demonstrating list, tree, tags, searchTags, and links resolver abuse.

Detection Methods for CVE-2026-92774

Indicators of Compromise

• GraphQL requests from low-privilege user sessions targeting pages.list, pages.tree, pages.tags, pages.searchTags, and pages.links operations at abnormal volumes.
• Repeated enumeration queries against the Wiki.js GraphQL endpoint originating from a single account or IP within short time windows.
• Access log entries showing metadata retrieval for pages that the requesting user has never opened through the standard UI.

Detection Strategies

• Baseline normal GraphQL query patterns per user role and alert on deviations, especially bulk metadata pulls from non-administrative accounts.
• Correlate application logs with authentication logs to identify accounts querying restricted tag namespaces they do not own.
• Inspect reverse-proxy logs for POST requests to /graphql containing the affected resolver names combined with pagination arguments used to enumerate content.

Monitoring Recommendations

• Forward Wiki.js application, web server, and authentication logs to a centralized SIEM for correlation across sessions.
• Enable verbose GraphQL query logging on the Wiki.js server to capture resolver names, arguments, and requesting user identity.
• Monitor outbound egress from the Wiki.js host for unusual data volumes that may indicate mass metadata exfiltration following exploitation.

How to Mitigate CVE-2026-92774

Immediate Actions Required

• Restrict GraphQL endpoint access to trusted networks or authenticated administrative users until a patched release is deployed.
• Audit existing tag-based page rules and treat any content protected only by tag rules as potentially exposed to all authenticated users.
• Rotate or revoke low-trust accounts that may have been used to enumerate restricted metadata during the exposure window.

Patch Information

At the time of publication, no fixed version has been referenced in the NVD entry for Wiki.js beyond 2.5.314. Administrators should track the Requarks Wiki repository and the VulnCheck advisory for a security release addressing the resolver authorization gap.

Workarounds

• Replace tag-based access restrictions with path-based or explicit page-identifier rules that are enforced by the affected resolvers.
• Move sensitive content into locked page groups or private namespaces that are excluded from public listing entirely.
• Place the Wiki.js GraphQL endpoint behind a reverse proxy that blocks unauthenticated access and rate-limits resolver queries per user.

# Example NGINX snippet to rate-limit GraphQL queries per client IP
limit_req_zone $binary_remote_addr zone=wiki_graphql:10m rate=10r/m;

location /graphql {
    limit_req zone=wiki_graphql burst=5 nodelay;
    proxy_pass http://wikijs_upstream;
}