Is CVE-2026-37106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37106 being exploited in the wild.

How severe is CVE-2026-37106?

Informational severity, with a CVSS score of 9.8, published 30 June 2026.

Which products and versions are affected?

DokuWiki 2025-05-14b "Librarian" 56.2.

Is there a fix for CVE-2026-37106?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37106 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-37106?

Check whether you run DokuWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37106: DokuWiki incorrect access control in user registration function

CVE-2026-37106 · Severity: info · CVSS 9.8 · Published 2026-06-30

DokuWiki, a popular open-source wiki software, contains a security flaw in its user registration process. An unauthorized attacker can bypass security checks to create new user accounts on the system. Depending on how the wiki is configured, this can lead to an immediate takeover of the site, allowing the attacker to modify content or access restricted information.

Technologies: DokuWiki. Vendors: DokuWiki.

Quick answers

Is CVE-2026-37106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37106 being exploited in the wild.
How severe is CVE-2026-37106?: Informational severity, with a CVSS score of 9.8, published 30 June 2026.
Which products and versions are affected?: DokuWiki 2025-05-14b "Librarian" 56.2.
Is there a fix for CVE-2026-37106?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37106 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-37106?: Check whether you run DokuWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect access control vulnerability exists in the register() function within inc/auth.php of DokuWiki. The function fails to validate CSRF tokens and lacks sufficient authentication checks, allowing unauthenticated remote attackers to trigger account creation via crafted HTTP POST requests. If the 'autopasswd' configuration is disabled (set to 0), attackers can specify their own password during registration, resulting in immediate account takeover. If 'autopasswd' is enabled (default), the impact is mitigated by the requirement to access the registered email, though unauthorized account creation still occurs. Recommended fixes include implementing checkSecurityToken() and enforcing stricter registration logic.

Affected products

DokuWiki DokuWiki 2025-05-14b "Librarian" 56.2

Timeline

2026-06-25: disclosed: Initial vulnerability details shared via GitHub Gist
2026-06-30: advisory: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.