Incorrect authorization in Wiki.js - #VU165826

Vulnerability details

The vulnerability allows a remote user to read restricted page content and relocate protected pages outside the paths covered by their access-denial rules.

The vulnerability exists due to incorrect authorization in the Wiki.js folder rename, move and duplicate endpoints when processing descendant pages without evaluating their individual page rules. A remote user can rename, move or duplicate a parent folder on which they hold manage:pages permission to place restricted descendant pages at paths allowed by a broader rule, disclose their full content and, through rename or move, remove the original pages from the protection of the applicable denial rules.

Affected software

Remediation

External References

• https://github.com/requarks/wiki/security/advisories/GHSA-7mf7-wprw-7fjm

Related Security Bulletins

• Multiple vulnerabilities in Wiki.js