Access Control Bypass in Wiki.js via Path Prefix Confusion

Wiki.js through version 2.5.314 contains an access control bypass vulnerability (CVE-2026-92776) resulting from a flaw in how the application validates START and END page rules. The application fails to strictly require path separators when enforcing these rules, which allows an attacker with legitimate access to a specific folder to inadvertently or maliciously access, read, and modify pages outside their authorized scope, provided those pages share a common name prefix with the authorized folder. This vulnerability can lead to unauthorized information disclosure and modification of wiki content by authenticated users who have been granted restricted access. This is a critical concern for environments relying on Wiki.js for sensitive documentation management where organizational boundaries are enforced through path-based permissions.

Impact

Successful exploitation allows authenticated users to bypass intended access control lists (ACLs). An attacker could view sensitive documentation or modify pages they are not authorized to access. This primarily affects organizations using Wiki.js to host confidential or internal documentation where fine-grained folder-level permissions are required to segregate user access.

Recommendation

• Upgrade Wiki.js to a version later than 2.5.314 to ensure proper path separator enforcement in ACL rules.
• Audit existing page permissions and folder structures for overlapping naming conventions that may be susceptible to prefix-based bypasses.
• Review web server access logs for anomalous access patterns where users are accessing documentation paths outside of their assigned organizational units or roles.