Access Control Vulnerability in Wiki.js by Requarks
CVE-2026-92776

8.6HIGH

Key Information:

Vendor

Requarks

Status
Wiki.js
Vendor
CVE Published:
16 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-92776?

Wiki.js versions up to 2.5.314 exhibit a flaw in the authorization mechanism that fails to enforce strict path separation when applying START and END page rules. This oversight permits attackers to access and modify files that share similar prefixes with permitted folders, thereby circumventing access controls meant to protect sensitive information. Users misconfigured with such permissions may inadvertently expose unrelated pages, compromising the integrity and confidentiality of the application.

Affected Version(s)

Wiki.js 0 <= 2.5.314

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-92776 - Proof of Concept

References

https://github.com/geo-chen/oss/blob/main/wiki.md#finding...
technical-descriptionexploit
https://github.com/requarks/wiki/blob/v2.5.314/server/cor...
technical-description
https://github.com/requarks/wiki
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.