Missing Authorization in Wiki.js - #VU165828
Published: November 11, 2026
Vulnerability details
The vulnerability allows a remote user to re-enable previously removed page scripts without script-authoring permission, compromising the integrity of content presented to readers.
The vulnerability exists due to missing authorization in the restorePage function in backend/models/pages.ts when restoring deleted pages. A remote user can submit a page restoration request with delete:pages permission to restore scripts verbatim from the deletion snapshot without passing the buildScripts() permission gate, causing readers of the restored page to load those scripts again.
The restoring user cannot supply a script of their own choosing; the script URL must already exist in the deletion snapshot from an earlier authorized author.