SB20261111154 - Multiple vulnerabilities in Wiki.js

Description

This security bulletin contains information about 3 vulnerabilities.

1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to re-enable previously removed page scripts without script-authoring permission, compromising the integrity of content presented to readers.

The vulnerability exists due to missing authorization in the restorePage function in backend/models/pages.ts when restoring deleted pages. A remote user can submit a page restoration request with delete:pages permission to restore scripts verbatim from the deletion snapshot without passing the buildScripts() permission gate, causing readers of the restored page to load those scripts again.

The restoring user cannot supply a script of their own choosing; the script URL must already exist in the deletion snapshot from an earlier authorized author.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to potentially access block metadata and configuration belonging to another site without authorization.

The vulnerability exists due to incorrect authorization in the mayListBlocks() function in backend/api/blocks.ts when handling requests to GET /sites/:siteId/blocks. A remote user can request block definitions for another site using page-authoring permissions restricted to a different site to potentially gain unauthorized access, because the function checks for write:pages or manage:pages permissions without verifying that the granting rule applies to the requested site.

3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass filename-scoped asset permissions and place an attacker-controlled asset under a protected filename.

The vulnerability exists due to missing destination authorization in the Wiki.js asset rename endpoint in backend/api/assets.ts when changing an asset's filename without changing its folder or locale. A remote user can submit a rename request for a source asset on which they hold manage:assets permission to move it to a filename denied by group permission rules, changing which access rules govern the asset.

The destination filename must be unoccupied; renaming to an existing filename returns a conflict (409), preventing overwriting an existing protected file.

Remediation

Install update from vendor's website.

References

• https://github.com/requarks/wiki/security/advisories/GHSA-fxw3-8676-67fm
• https://github.com/requarks/wiki/security/advisories/GHSA-x9r2-wh7w-h4qc
• https://github.com/requarks/wiki/security/advisories/GHSA-2rx3-7vrr-h3gv