CVE-2026-37106
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In DokuWiki 2025-05-14b 'Librarian' 56.2, a remote attacker can create an account via the register function in inc/auth.php. The supplier disputes this as a vulnerability, stating it is intentional behavior when self-registration is enabled (a non-default feature) and there is no scenario where it would be enabled without administrator knowledge.
Risk Assessment
The risk involves potential unauthorized access to the system if self-registration were enabled without administrator knowledge, which could lead to uncontrolled account creation and privilege escalation.
Recommendation
It is recommended to review the DokuWiki configuration and ensure that the self-registration option is disabled if not required. Regularly audit security settings and update the software to the latest version.
Other vulnerabilities in DokuWiki
See allOriginal NVD description (English source)
An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS