Executive brief
Wiki.js is an open-source platform used by organizations to create and manage documentation. A security flaw allows users with basic moderator permissions (specifically the ability to manage users) to grant themselves full administrative access to the entire system. Once an attacker becomes an administrator, they can read sensitive user data, modify all wiki content, or potentially take control of the underlying server.
Technical details
The 'users.update' GraphQL mutation in Wiki.js fails to validate group IDs provided in the 'groups' array. The resolver in 'server/graph/resolvers/user.js' passes arguments directly to the 'updateUser' model without checking the caller's identity or restricting which groups can be assigned. Because the authorization directive uses OR logic, a user with only 'manage:users' (typically a moderator) can call this mutation on their own account ID and include the ID for the Administrators group (ID 1). Upon re-authentication, the user receives a new JWT containing 'manage:system' permissions, granting full administrative control. This is fixed in version 2.5.313.
Affected products
- requarks Wiki.js <= 2.5.312
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE-2026-44224 published to NVD
- 2026-05-12: patched: Fixed in version 2.5.313