Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44224

Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their ow
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cd939148f2a32241804edcc3e32940b7bc9b677444f64071650c71d1fa86123b
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"wiki","vendor":"requarks","versions":[{"status":"affected","version":"< 2.5.313"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:967a8d5ecad15dacf3cf228f796897a9866a7e7a23d86f99ad0b1f429735fed3 · sha256:07e71696351be98c… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:967a8d5ecad15dacf3cf228f796897a9866a7e7a23d86f99ad0b1f429735fed3 · sha256:07e71696351be98c… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-269","description":"CWE-269: Improper Privilege Management","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:967a8d5ecad15dacf3cf228f796897a9866a7e7a23d86f99ad0b1f429735fed3 · sha256:07e71696351be98c… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"tags":["exploit"],"url":"https://github.com/requarks/wiki/security/advisories/GHSA-cq3g-mwrg-v2rv"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:967a8d5ecad15dacf3cf228f796897a9866a7e7a23d86f99ad0b1f429735fed3 · sha256:07e71696351be98c… · /containers/adp/0/references/0
{"name":"https://github.com/requarks/wiki/security/advisories/GHSA-cq3g-mwrg-v2rv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/requarks/wiki/security/advisories/GHSA-cq3g-mwrg-v2rv"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:967a8d5ecad15dacf3cf228f796897a9866a7e7a23d86f99ad0b1f429735fed3 · sha256:07e71696351be98c… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer