Incorrect authorization in Wiki.js - #VU165823
Published: November 11, 2026
Vulnerability identifier: #VU165823
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose titles, paths, descriptions, tags and timestamps of unpublished draft or scheduled pages in Wiki.js.
The vulnerability exists due to incorrect authorization in the tree listing, backlinks, links and tag-count endpoints when handling requests for page metadata without enforcing publication-state visibility checks. A remote attacker can query these endpoints for paths accessible through read:pages, including as a guest where public reading is enabled, to obtain metadata about pages that are not live.
The disclosure is limited to page metadata; page bodies are not exposed.
Affected software
Wiki.js
Remediation
Install security update from vendor's website.
Wiki.js - update to 3.1.0