Executive brief
Wiki.js is an open-source wiki platform that allows organizations to create and manage internal documentation with access controls. This vulnerability allows attackers to bypass tag-based access restrictions and retrieve sensitive page metadata (titles, descriptions, paths) through GraphQL queries without proper authorization, potentially exposing confidential documentation to unauthorized users.
Technical details
Wiki.js versions through 2.5.314 fail to enforce tag-based authorization checks in multiple GraphQL resolvers (pages.list, pages.tree, pages.tags, pages.searchTags, and pages.links). The vulnerability is a broken access control issue where the authorization logic omits page tags from validation, allowing an unauthenticated or low-privilege attacker to query GraphQL endpoints and retrieve restricted page metadata including titles, descriptions, paths, and associated tags. The attack requires network access to the GraphQL API endpoint but no specific authentication bypass; the bug is in the permission evaluation logic itself. Attackers can enumerate pages that should be restricted based on tag-based access policies and harvest sensitive information about organizational structure and documentation content.
Affected products
- Requarks Wiki.js through 2.5.314
Timeline
- 2026-09-16: disclosed