CVE-2026-92774

Overview

Wiki.js versions up to 2.5.314 allow attackers to bypass tag‑based access controls in several GraphQL resolvers. This flaw lets unauthenticated or improperly authorized users retrieve restricted page metadata such as titles, descriptions, paths, and tag lists.

Description

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.

Impact

{'confidentiality': 'Unauthorized disclosure of page metadata (titles, descriptions, paths, tags) that may be used to map sensitive content or plan further attacks.', 'integrity': 'No direct impact on data integrity.', 'availability': 'No impact on availability.'}

Remediation

['Upgrade Wiki.js to version 2.5.315 or later where the GraphQL authorization checks are fixed.', 'If an upgrade is not immediately possible, restrict GraphQL endpoints to authenticated users only and enforce tag‑based authorization checks manually.', 'Audit existing GraphQL queries for potential unauthorized data exposure and apply rate limiting or request filtering as a temporary safeguard.']

Risk context

The vulnerability has a medium CVSS v3 score of 4.3 and a CVSS v4 score of 5.3. While it does not affect availability or integrity, it can expose sensitive metadata that may aid attackers. Prompt patching or mitigation is recommended to prevent information leakage.

Affected products

• Wiki.js 2.5.314 and earlier