CVE-2026-92776 — Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Use…
Published: 2026-09-16 · CVSS: 8.6 · CVSS 4.0
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7