CVE-2026-92776 Overview
CVE-2026-92776 is an authorization bypass vulnerability in Wiki.js through version 2.5.314. The page permission rule engine matches START and END page rules using literal prefix comparisons without enforcing path segment boundaries. Users granted access to a specific folder can read and modify unrelated pages whose paths share a literal prefix with the authorized folder. The flaw is classified under CWE-863: Incorrect Authorization and affects the authentication logic in server/core/auth.js.
Critical Impact
Authenticated users can bypass folder-level access controls to read and modify pages outside their authorized scope, breaking tenant and content isolation in shared Wiki.js deployments.
Affected Products
- Wiki.js (Requarks) versions through 2.5.314
- Deployments relying on START and END page permission rules for access segmentation
- Multi-team or multi-tenant Wiki.js instances using folder-based authorization
Discovery Timeline
- 2026-09-16 - CVE-2026-92776 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92776
Vulnerability Analysis
Wiki.js implements page-level access control through rules that match page paths against permitted prefixes. The permission rule engine, located in server/core/auth.js around lines 252-263, evaluates START and END match modes using string prefix comparison. The engine does not verify that a path separator terminates the matched prefix. As a result, a rule granting access to finance also matches finance-public, financials, and any other path beginning with the literal string finance.
This breaks the security assumption that folder rules confine access to descendants of that folder. Any authenticated user with a folder-scoped grant gains equivalent read or write permissions on unrelated pages whose slugs share the same prefix. The impact scales with the number of shared prefixes in the wiki's namespace.
Root Cause
The root cause is missing path segment boundary validation in the rule matching function. Correct authorization for hierarchical paths requires matching either the exact path or the prefix followed by a path separator such as /. Wiki.js compares strings using a literal prefix check, treating finance and finance-reports as belonging to the same authorization scope. See the GitHub Requarks Auth Code Review for the exact logic.
Attack Vector
An attacker requires an authenticated account with at least one folder-scoped permission rule. The attacker enumerates page paths in the wiki and identifies pages whose slugs share a prefix with their authorized folder. Requests to those pages succeed because the permission engine matches the shared prefix and returns an allow decision. No specialized tooling or crafted payloads are required; standard Wiki.js API and UI requests suffice. Full technical detail is documented in the GitHub Wiki Permission Analysis and the VulnCheck Advisory on Wiki.js.
Detection Methods for CVE-2026-92776
Indicators of Compromise
- Access log entries showing authenticated users retrieving or editing pages outside their nominal folder scope.
- Audit events where a user's page views span multiple top-level path prefixes that share leading characters.
- Unexpected edit history entries on sensitive pages authored by accounts scoped to sibling folders.
Detection Strategies
- Correlate the requesting user's permission rules with the actual page paths served in HTTP 200 responses from /e/, /i/, and API endpoints.
- Flag any request where the served page path matches an authorized rule by literal prefix but not by full path segment boundary.
- Baseline expected page access patterns per role and alert on deviations that indicate prefix collision abuse.
Monitoring Recommendations
- Enable verbose authorization logging in Wiki.js and forward events to a centralized log platform for query and retention.
- Review the page permission ruleset for prefixes that overlap with sibling page slugs, and inventory those collisions.
- Monitor the Wiki.js database pages table for edits by users lacking legitimate access to the affected namespace.
How to Mitigate CVE-2026-92776
Immediate Actions Required
- Inventory all START and END permission rules and identify prefixes that collide with unrelated page paths.
- Restrict privileged content behind path prefixes that cannot be a literal prefix of any other page slug.
- Reduce the number of authenticated accounts holding folder-scoped write permissions until a patched release is deployed.
Patch Information
At the time of publication, the CVE record identifies Wiki.js through 2.5.314 as affected. Monitor the GitHub Requarks Wiki Repository for a fixed release that enforces path segment boundaries in the permission rule engine, and apply the update as soon as it is available.
Workarounds
- Rename pages and folders so that no authorized folder path is a literal prefix of another page slug (for example, use finance/ semantics enforced by appending unique terminators).
- Replace overlapping START and END rules with EXACT or REGEX match rules that anchor the path boundary explicitly.
- Remove folder-scoped permissions from low-trust user groups and grant per-page access where sensitive content is at risk.
# Example: enumerate Wiki.js permission rules with potentially overlapping prefixes
# Run against the Wiki.js Postgres database (read-only)
psql -h <host> -U <user> -d wiki -c \
"SELECT id, path, roleId, match FROM pageRules WHERE match IN ('START','END') ORDER BY path;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.