Executive brief
LeafWiki is a self-hosted wiki platform that allows teams to create and manage internal documentation. An authenticated user can exploit a flaw in the account management API to illegally promote themselves from a regular user role (such as viewer) to an administrator. This gives an attacker complete control over the wiki, including the ability to view all content, modify pages, manage other users, and disrupt service availability.
Technical details
The vulnerability is an improper privilege management flaw (CWE-269) in the PUT /api/users/<userID> endpoint. The endpoint accepts a role parameter from user requests and saves it without authorization checks to verify that only administrators can change roles. An authenticated attacker can send a crafted request to modify their own user account and set the role field to "admin", bypassing role-based access controls. The attack requires a valid user account but no admin privileges, network-level access to the wiki API, and no user interaction. Successful exploitation grants full administrative access. The fix is available in version 0.10.1 and later.
Affected products
- perber LeafWiki 0.1.0 through 0.10.0
Timeline
- 2026-05-31: disclosed: Advisory published on GitHub
- 2026-08-21: advisory: CVE-2026-53527 published
- 2026-05-31: patched: Fix released in version 0.10.1