Executive brief
DokuWiki, a popular open-source wiki software, contains a security flaw in its user registration process. An unauthorized attacker can bypass security checks to create new user accounts on the system. Depending on how the wiki is configured, this can lead to an immediate takeover of the site, allowing the attacker to modify content or access restricted information.
Technical details
An incorrect access control vulnerability exists in the register() function within inc/auth.php of DokuWiki. The function fails to validate CSRF tokens and lacks sufficient authentication checks, allowing unauthenticated remote attackers to trigger account creation via crafted HTTP POST requests. If the 'autopasswd' configuration is disabled (set to 0), attackers can specify their own password during registration, resulting in immediate account takeover. If 'autopasswd' is enabled (default), the impact is mitigated by the requirement to access the registered email, though unauthorized account creation still occurs. Recommended fixes include implementing checkSecurityToken() and enforcing stricter registration logic.
Affected products
- DokuWiki DokuWiki 2025-05-14b "Librarian" 56.2
Timeline
- 2026-06-25: disclosed: Initial vulnerability details shared via GitHub Gist
- 2026-06-30: advisory: CVE published to NVD dataset