SB20261111153 - Multiple vulnerabilities in Wiki.js

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete pages and permanently delete uploaded files without the required deletion permissions in folders they manage.

The vulnerability exists due to incorrect authorization in the Wiki.js folder deletion endpoint when handling folder deletion requests. A remote user can send a DELETE request to /_api/sites/:siteId/tree/folders/:folderId with manage:pages permission on the folder to delete all descendant pages and uploaded files without delete:pages or manage:assets permission, even when explicit rules deny those permissions.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read restricted page content and relocate protected pages outside the paths covered by their access-denial rules.

The vulnerability exists due to incorrect authorization in the Wiki.js folder rename, move and duplicate endpoints when processing descendant pages without evaluating their individual page rules. A remote user can rename, move or duplicate a parent folder on which they hold manage:pages permission to place restricted descendant pages at paths allowed by a broader rule, disclose their full content and, through rename or move, remove the original pages from the protection of the applicable denial rules.

Remediation

Install update from vendor's website.

References

• https://github.com/requarks/wiki/security/advisories/GHSA-p5rv-hmh3-wrv8
• https://github.com/requarks/wiki/security/advisories/GHSA-7mf7-wprw-7fjm