CVE-2026-44224: Requarks Wiki.js privilege escalation in users.update GraphQL mutation

CVE-2026-44224 · Severity: info · CVSS 8.6 · Published 2026-05-12

Wiki.js is an open-source platform used by organizations to create and manage documentation. A security flaw allows users with basic moderator permissions (specifically the ability to manage users) to grant themselves full administrative access to the entire system. Once an attacker becomes an administrator, they can read sensitive user data, modify all wiki content, or potentially take control of the underlying server.

Technologies: Requarks Wiki.js. Vendors: Requarks.

Quick answers

Is CVE-2026-44224 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44224 being exploited in the wild.
How severe is CVE-2026-44224?
Informational severity, with a CVSS score of 8.6, published 12 May 2026.
Which products and versions are affected?
Requarks Wiki.js <= 2.5.312.
Is there a fix for CVE-2026-44224?
A patch was published on 2026-05-12: Fixed in version 2.5.313 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44224 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44224?
Check whether you run Requarks Wiki.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'users.update' GraphQL mutation in Wiki.js fails to validate group IDs provided in the 'groups' array. The resolver in 'server/graph/resolvers/user.js' passes arguments directly to the 'updateUser' model without checking the caller's identity or restricting which groups can be assigned. Because the authorization directive uses OR logic, a user with only 'manage:users' (typically a moderator) can call this mutation on their own account ID and include the ID for the Administrators group (ID 1). Upon re-authentication, the user receives a new JWT containing 'manage:system' permissions, granting full administrative control. This is fixed in version 2.5.313.

Affected products

  • requarks Wiki.js <= 2.5.312

Timeline

  • 2026-04-28: advisory: GitHub Security Advisory published
  • 2026-05-12: disclosed: CVE-2026-44224 published to NVD
  • 2026-05-12: patched: Fixed in version 2.5.313

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.