CVE-2026-44224
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Wiki.js prior to version 2.5.313 has a vulnerability that allows users to self-assign to the Administrators group by modifying arguments in the GraphQL mutation. The lack of validation on group IDs enables unauthorized elevation of privileges.
Risk Assessment
Organizations may be exposed to unauthorized access to full administrator privileges, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update Wiki.js to version 2.5.313 or later to mitigate this vulnerability and implement additional access controls on the GraphQL mutation.
Other vulnerabilities in Wiki.js
See all- CVE-2025-56643Critical
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.
- CVE-2026-92776High
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
- CVE-2026-92775Medium
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.
- CVE-2026-92774Medium
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.
Original NVD description (English source)
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS