Quick answers
- Is CVE-2026-92776 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92776 being exploited in the wild.
- How severe is CVE-2026-92776?
- High severity, with a CVSS score of 8.1, published 16 September 2026.
- Which products and versions are affected?
- Requarks Wiki.js through 2.5.314.
- Is there a fix for CVE-2026-92776?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92776 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-92776?
- Check whether you run Requarks Wiki.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Wiki.js versions up to 2.5.314 fail to enforce path-segment boundaries when evaluating START and END page permission rules. The vulnerability exists in the page permission rule engine, which grants read and write access to any page whose path shares a literal prefix with an allowed path, without checking for proper path separators. For example, a user granted access to the path "docs" can access "docs123" or any other page beginning with that string. An authenticated attacker with access to a permitted folder can exploit this to access and modify unrelated pages sharing the same prefix, completely bypassing intended access controls. No patch is currently mentioned in available advisories.
Affected products
- Requarks Wiki.js through 2.5.314
Timeline
- 2026-09-16: disclosed