Incorrect authorization in Wiki.js - #VU165825
Published: November 11, 2026
Vulnerability identifier: #VU165825
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to delete pages and permanently delete uploaded files without the required deletion permissions in folders they manage.
The vulnerability exists due to incorrect authorization in the Wiki.js folder deletion endpoint when handling folder deletion requests. A remote user can send a DELETE request to /_api/sites/:siteId/tree/folders/:folderId with manage:pages permission on the folder to delete all descendant pages and uploaded files without delete:pages or manage:assets permission, even when explicit rules deny those permissions.
Affected software
Wiki.js
Remediation
Install security update from vendor's website.
Wiki.js - update to 3.1.1