Is CVE-2026-92776 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92776?

CVE-2026-92776 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-92776

Description

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.