Insufficient Session Expiration in Wiki.js - #VU159303
Published: November 4, 2026
Vulnerability identifier: #VU159303
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retain authenticated access to a deactivated Wiki.js account, including write access and the ability to change the account's password.
The vulnerability exists due to insufficient session expiration in Wiki.js web session validation when processing requests for deactivated accounts without rechecking their active status. A remote user can reuse a session obtained before deactivation to continue accessing the account and change its password through PUT /_api/users/profile/password.
Affected software
Wiki.js
Remediation
Install security update from vendor's website.
Wiki.js - update to 3.0.2