SB2026110478 - Insufficient Session Expiration in Wiki.js

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110478

SB2026110478 - Insufficient Session Expiration in Wiki.js

Published: November 4, 2026

Security Bulletin ID SB2026110478
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to retain authenticated access to a deactivated Wiki.js account, including write access and the ability to change the account's password.

The vulnerability exists due to insufficient session expiration in Wiki.js web session validation when processing requests for deactivated accounts without rechecking their active status. A remote user can reuse a session obtained before deactivation to continue accessing the account and change its password through PUT /_api/users/profile/password.


Remediation

Install update from vendor's website.

References