CVE-2026-92776

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92776
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92776.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92776
Published
2026-09-16T20:32:36Z
Modified
2026-09-20T11:30:45Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass
Details

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92776.json"
}
References

Affected packages

Git / github.com/requarks/wiki

Affected ranges

Type
GIT
Repo
https://github.com/requarks/wiki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6f042e97cc2d3acda6b6ff611de8e0faacce91c1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.314"
        },
        {
            "introduced": "Wiki.js"
        },
        {
            "fixed": "2.5.314"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

2.*
2.0.0-beta.11
2.0.0-beta.115
2.0.0-beta.147
2.0.0-beta.148
2.0.0-beta.174
2.0.0-beta.180
2.0.0-beta.203
2.0.0-beta.208
2.0.0-beta.230
2.0.0-beta.241
2.0.0-beta.267
2.0.0-beta.268
2.0.0-beta.275
2.0.0-beta.303
2.0.0-beta.42
2.0.0-beta.68
2.0.0-beta.84
2.0.0-beta.91
2.0.0-rc.1
2.0.0-rc.17
2.0.1
2.0.12
2.1.113
2.2.50
2.2.51
2.3.71
2.3.72
2.3.77
2.4.105
2.4.107
2.4.75
2.5.105
2.5.117
2.5.121
2.5.126
2.5.132
2.5.136
2.5.144
2.5.159
2.5.170
2.5.191
2.5.197
2.5.201
2.5.214
2.5.219
2.5.254
2.5.255
2.5.260
2.5.264
2.5.268
2.5.272
2.5.274
v1.*
v1.0-alpha.1
v1.0-alpha.2
v1.0-alpha.3
v1.0-alpha.4
v1.0-alpha.5
v1.0-alpha.6
v1.0-alpha.7
v1.0-beta.1
v1.0-beta.2
v1.0-beta.3
v1.0-beta.4
v1.0-beta.5
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.12
v1.0.0-beta.13
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v2.*
v2.5.275
v2.5.276
v2.5.277
v2.5.278
v2.5.279
v2.5.280
v2.5.281
v2.5.282
v2.5.283
v2.5.284
v2.5.285
v2.5.286
v2.5.287
v2.5.288
v2.5.289
v2.5.290
v2.5.291
v2.5.292
v2.5.293
v2.5.294
v2.5.295
v2.5.296
v2.5.297
v2.5.298
v2.5.299
v2.5.300
v2.5.301
v2.5.302
v2.5.303
v2.5.304
v2.5.305
v2.5.306
v2.5.307
v2.5.308
v2.5.309
v2.5.310
v2.5.311
v2.5.312
v2.5.313

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92776.json"