CVE-2026-53527: LeafWiki privilege escalation in user update API

CVE-2026-53527 · Severity: high · CVSS 8.8 · Published 2026-08-21

LeafWiki is a self-hosted wiki platform that allows teams to create and manage internal documentation. An authenticated user can exploit a flaw in the account management API to illegally promote themselves from a regular user role (such as viewer) to an administrator. This gives an attacker complete control over the wiki, including the ability to view all content, modify pages, manage other users, and disrupt service availability.

Quick answers

Is CVE-2026-53527 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53527 being exploited in the wild.
How severe is CVE-2026-53527?
High severity, with a CVSS score of 8.8, published 21 August 2026.
Which products and versions are affected?
perber LeafWiki 0.1.0 through 0.10.0.
Is there a fix for CVE-2026-53527?
A patch was published on 2026-05-31: Fix released in version 0.10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53527 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-53527?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper privilege management flaw (CWE-269) in the PUT /api/users/<userID> endpoint. The endpoint accepts a role parameter from user requests and saves it without authorization checks to verify that only administrators can change roles. An authenticated attacker can send a crafted request to modify their own user account and set the role field to "admin", bypassing role-based access controls. The attack requires a valid user account but no admin privileges, network-level access to the wiki API, and no user interaction. Successful exploitation grants full administrative access. The fix is available in version 0.10.1 and later.

Affected products

  • perber LeafWiki 0.1.0 through 0.10.0

Timeline

  • 2026-05-31: disclosed: Advisory published on GitHub
  • 2026-08-21: advisory: CVE-2026-53527 published
  • 2026-05-31: patched: Fix released in version 0.10.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.