CVE-2026-37106
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In DokuWiki 2025-05-14b 'Librarian' 56.2, a remote attacker can create an account via the register function in inc/auth.php. The supplier disputes this as a vulnerability, stating it is intentional behavior when self-registration is enabled (a non-default feature) and there is no scenario where it would be enabled without administrator knowledge.
Risk Assessment
The risk involves potential unauthorized access to the system if self-registration were enabled without administrator knowledge, which could lead to uncontrolled account creation and privilege escalation.
Recommendation
It is recommended to review the DokuWiki configuration and ensure that the self-registration option is disabled if not required. Regularly audit security settings and update the software to the latest version.
Original NVD description (English source)
An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.