CVE-2026-92774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92774
Published
2026-09-16T20:32:34Z
Modified
2026-09-19T03:31:02Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission
Details

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92774.json"
}
References

Affected packages

Git / github.com/requarks/wiki

Affected ranges

Type
GIT
Repo
https://github.com/requarks/wiki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6f042e97cc2d3acda6b6ff611de8e0faacce91c1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.314"
        },
        {
            "introduced": "Wiki.js"
        },
        {
            "fixed": "2.5.314"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

2.*
2.0.0-beta.11
2.0.0-beta.115
2.0.0-beta.147
2.0.0-beta.148
2.0.0-beta.174
2.0.0-beta.180
2.0.0-beta.203
2.0.0-beta.208
2.0.0-beta.230
2.0.0-beta.241
2.0.0-beta.267
2.0.0-beta.268
2.0.0-beta.275
2.0.0-beta.303
2.0.0-beta.42
2.0.0-beta.68
2.0.0-beta.84
2.0.0-beta.91
2.0.0-rc.1
2.0.0-rc.17
2.0.1
2.0.12
2.1.113
2.2.50
2.2.51
2.3.71
2.3.72
2.3.77
2.4.105
2.4.107
2.4.75
2.5.105
2.5.117
2.5.121
2.5.126
2.5.132
2.5.136
2.5.144
2.5.159
2.5.170
2.5.191
2.5.197
2.5.201
2.5.214
2.5.219
2.5.254
2.5.255
2.5.260
2.5.264
2.5.268
2.5.272
2.5.274
v1.*
v1.0-alpha.1
v1.0-alpha.2
v1.0-alpha.3
v1.0-alpha.4
v1.0-alpha.5
v1.0-alpha.6
v1.0-alpha.7
v1.0-beta.1
v1.0-beta.2
v1.0-beta.3
v1.0-beta.4
v1.0-beta.5
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.12
v1.0.0-beta.13
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v2.*
v2.5.275
v2.5.276
v2.5.277
v2.5.278
v2.5.279
v2.5.280
v2.5.281
v2.5.282
v2.5.283
v2.5.284
v2.5.285
v2.5.286
v2.5.287
v2.5.288
v2.5.289
v2.5.290
v2.5.291
v2.5.292
v2.5.293
v2.5.294
v2.5.295
v2.5.296
v2.5.297
v2.5.298
v2.5.299
v2.5.300
v2.5.301
v2.5.302
v2.5.303
v2.5.304
v2.5.305
v2.5.306
v2.5.307
v2.5.308
v2.5.309
v2.5.310
v2.5.311
v2.5.312
v2.5.313

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92774.json"