---
id: CVE-2026-92774
title: >-
  Wiki.js through 2.5.314 omits page tags from authorization checks in multiple
  GraphQL resolvers, allowing tag-based access restrictions to be bypassed
summary: >-
  Wiki.js through 2.5.314 omits page tags from authorization checks in multiple
  GraphQL resolvers, allowing tag-based access restrictions to be bypassed.
  Attackers can query the list, tree, tags, searchTags, and links resolvers to
  retrieve…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-863
vendor: requarks
product: Wiki.js
affected:
  - Wiki.js <= 2.5.314
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:47:31.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92774'
references:
  - url: >-
      https://github.com/geo-chen/oss/blob/main/wiki.md#finding-1-tag-based-page-rule-access-restrictions-bypassed-in-pageslisttreetagslinks-graphql-queries-leaking-restricted-page-metadata
    label: disclosure@vulncheck.com
  - url: 'https://github.com/requarks/wiki'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/requarks/wiki/blob/v2.5.314/server/graph/resolvers/page.js#L136-L139
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/requarks/wiki/blob/v2.5.314/server/graph/resolvers/page.js#L58-L62
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-authorization-bypass-via-graphql-tag-omission
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00367
epssPercentile: 0.2782
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T15:02:06.124431Z'
ingestedAt: '2026-09-16T21:05:36.893Z'
---

## Overview

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.