Executive brief
Wiki.js is an open-source wiki platform used for creating and managing knowledge bases. A flaw in its page permission rules allows users who have access to a folder to read and modify unrelated pages that share a common prefix, bypassing intended access controls and potentially exposing sensitive documentation.
Technical details
Wiki.js versions up to 2.5.314 fail to enforce path-segment boundaries when evaluating START and END page permission rules. The vulnerability exists in the page permission rule engine, which grants read and write access to any page whose path shares a literal prefix with an allowed path, without checking for proper path separators. For example, a user granted access to the path "docs" can access "docs123" or any other page beginning with that string. An authenticated attacker with access to a permitted folder can exploit this to access and modify unrelated pages sharing the same prefix, completely bypassing intended access controls. No patch is currently mentioned in available advisories.
Affected products
- Requarks Wiki.js through 2.5.314
Timeline
- 2026-09-16: disclosed