CVE-2026-92776 PUBLISHED

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.

• George Chen finder

• Researcher write-up, finding 3
• START and END matchers use _.startsWith and _.endsWith with no boundary check
• https://github.com/requarks/wiki
• VulnCheck Advisory: Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

• Incorrect Authorization CWE