# CVE-2026-92776: Wiki.js path permission bypass in page rule engine

Source: https://junglewise.ai/threats/cve-2026-92776-wiki-js-path-permission-bypass-in-page-rule-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92776 · Severity: high · CVSS 8.1 · Published 2026-09-16

Wiki.js is an open-source wiki platform used for creating and managing knowledge bases. A flaw in its page permission rules allows users who have access to a folder to read and modify unrelated pages that share a common prefix, bypassing intended access controls and potentially exposing sensitive documentation.

Technologies: [Requarks Wiki.js](https://junglewise.ai/threats/technologies/wiki-js). Vendors: [Requarks](https://junglewise.ai/threats/vendors/requarks).

## Quick answers

**Is CVE-2026-92776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92776 being exploited in the wild.

**How severe is CVE-2026-92776?** High severity, with a CVSS score of 8.1, published 16 September 2026.

**Which products and versions are affected?** Requarks Wiki.js through 2.5.314.

**Is there a fix for CVE-2026-92776?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92776 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92776?** Check whether you run Requarks Wiki.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Wiki.js versions up to 2.5.314 fail to enforce path-segment boundaries when evaluating START and END page permission rules. The vulnerability exists in the page permission rule engine, which grants read and write access to any page whose path shares a literal prefix with an allowed path, without checking for proper path separators. For example, a user granted access to the path "docs" can access "docs123" or any other page beginning with that string. An authenticated attacker with access to a permitted folder can exploit this to access and modify unrelated pages sharing the same prefix, completely bypassing intended access controls. No patch is currently mentioned in available advisories.

## Affected products

- Requarks Wiki.js through 2.5.314

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/geo-chen/oss/blob/main/wiki.md](https://github.com/geo-chen/oss/blob/main/wiki.md)
- [https://github.com/requarks/wiki](https://github.com/requarks/wiki)

## Related threats

- [Wiki.js Image Prefetch server-side request forgery](https://junglewise.ai/threats/cve-2026-92775-wiki-js-image-prefetch-server-side-request-forgery)
- [Wiki.js authorization bypass in GraphQL resolvers via tag omission](https://junglewise.ai/threats/cve-2026-92774-wiki-js-authorization-bypass-in-graphql-resolvers-via-tag)
- [Requarks Wiki.js privilege escalation in users.update GraphQL mutation](https://junglewise.ai/threats/cve-2026-44224-requarks-wiki-js-privilege-escalation-in-users-update-graphql)
- [Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result…](https://junglewise.ai/threats/cve-2025-56643-requarks-wiki-js-2-5-307-does-not-properly-revoke-or-invalidate)