Missing Authorization in Wiki.js - #VU165830
Published: November 11, 2026
Vulnerability details
The vulnerability allows a remote user to bypass filename-scoped asset permissions and place an attacker-controlled asset under a protected filename.
The vulnerability exists due to missing destination authorization in the Wiki.js asset rename endpoint in backend/api/assets.ts when changing an asset's filename without changing its folder or locale. A remote user can submit a rename request for a source asset on which they hold manage:assets permission to move it to a filename denied by group permission rules, changing which access rules govern the asset.
The destination filename must be unoccupied; renaming to an existing filename returns a conflict (409), preventing overwriting an existing protected file.