ikiwiki 3.20161219 does not properly check if a revision changes the access permissions…
Priority LOW 37CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
Why it matters now
EPSS 0.02129 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10026
- 2026-10-03 Alias added: GHSA-r7m6-q359-fprm
References
Advisory 5
- http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/
- https://ikiwiki.info/security/#index46h2
- DSA-3760
- [oss-security] 20161221 Re: CVE request: ikiwiki: authorization bypass when reverting changes
- [oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery)
More Ikiwiki vulnerabilities
- TI-2017-00331 Authentication bypass via repeated parameters CVSS 3.0CRITICAL 9.8
- TI-2011-01233 ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks. CVSS 3.1HIGH 8.2
- TI-2019-06647 ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the… CVSS 3.0HIGH 7.5
- TI-2008-00155 Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows… CVSS 2.0MEDIUM 6.8
- TI-2016-07849 Editing restriction bypass for git revert CVSS 3.0MEDIUM 6.5
- TI-2015-02467 Cross-site scripting in ikiwiki CVSS 3.1MEDIUM 6.1
Sources
- CVE-2016-10026 · CVE Program
- CVE-2016-10026 · NVD
- FIRST EPSS
- GHSA-r7m6-q359-fprm · GitHub Advisory Database · CC BY 4.0
- CVE-2016-10026 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences