Read the docs
TI-2026-32203 Aliases CVE-2026-44224

Wiki.js: Privilege Escalation via Missing Group Validation in users.update

Priority HIGH 72CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed wiki (requarks): 2.5.313

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Requarkswikibefore 2.5.3132.5.313Patch availableCNA
  • wiki VendorRequarks Affected before 2.5.313 Fixed in 2.5.313 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:*before 2.5.313VulnerableRequarks
  • cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:* Versions before 2.5.313 Vulnerable ·Requarks

Remediation

  • Fix · CNA wiki (requarks) Fixed in 2.5.313

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44224

References

Exploit 1

  • TI-2021-07999 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor CVSS 3.1MEDIUM 5.4
  • TI-2025-35387 Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a… CVSS 3.1CRITICAL 9.1
  • TI-2020-12008 Directory Traversal in Wiki.js CVSS 3.1HIGH 8.6
  • TI-2022-07706 Improper write access check in Requarks/wiki CVSS 3.1HIGH 8.1
  • TI-2021-19662 Stored XSS in non-image uploads in Requarks/wiki CVSS 3.1HIGH 8.2
  • TI-2021-19661 Stored XSS via SVG in Requarks/wiki CVSS 3.1HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences