CVE-2026-92774
MediumCVSS 4.3Summary
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.
Risk Assessment
An unauthorized user can learn the structure and content of restricted pages, leading to information leakage. Exposed metadata can facilitate further targeted attacks.
Recommendation
Upgrade Wiki.js beyond version 2.5.314. Until patched, consider restricting GraphQL API access and auditing tag permissions.
Other vulnerabilities in Wiki.js
See all- CVE-2026-92776High
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
- CVE-2026-92775Medium
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.
- CVE-2026-44224High
Wiki.js prior to version 2.5.313 has a vulnerability that allows users to self-assign to the Administrators group by modifying arguments in the GraphQL mutation. The lack of validation on group IDs enables unauthorized elevation of privileges.
- CVE-2025-56643Critical
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.
Original NVD description (English source)
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.