Description

LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as `viewer`, to `admin`. Exploitation requires a valid authenticated LeafWiki user account. Instances without public registration and with only trusted users are at lower practical risk. Users should update to version 0.10.1 or greater. Until a patch is available, operators should restrict account creation and ensure that only trusted users have accounts on affected LeafWiki instances. If possible, access to the user update API should be restricted to trusted users or administrators only.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T22:16:39.147Z",
  "pubdate": "2026-08-21T22:16:39.147Z",
  "executiveSummary": "LeafWiki versions 0.1.0 through 0.10.0 contain a privilege escalation vulnerability within the user update API. This flaw enables an authenticated, low-privileged user, such as a viewer, to arbitrarily modify their own account role properties and elevate their privileges to the administrator tier. The primary impact of this vulnerability is a complete compromise of confidentiality, integrity, and availability of the affected wiki instance, as administrative privileges grant full control over the application state and hosted data.\nExploitation of this vulnerability requires a valid authenticated LeafWiki user account, meaning anonymous or unauthenticated attackers cannot exploit the flaw directly without prior access. Instances that restrict public user registration and maintain a strictly curated user base face lower practical risk. However, any environment permitting self-service registration or harboring untrusted standard users is susceptible to total account takeover and administrative dominion.\nOperators are strongly advised to update to version 0.10.1 or greater where the flaw is remediated. Until patching can be performed, risk can be mitigated by restricting account creation and ensuring that only trusted users retain access to the application.",
  "technicalDetails": "The vulnerability resides in the user update API of LeafWiki, specifically affecting versions 0.1.0 through 0.10.0. The root cause of the vulnerability stems from insufficient server-side authorization checks and improper input validation regarding role assignment parameters during account modification routines. When an authenticated user submits a request to update their profile via the user update API, the application fails to restrict or sanitize the role parameter, allowing the client to supply arbitrary role values.\nTo exploit this vulnerability, an attacker must first provision or compromise a standard low-privileged user account, such as a viewer role, within the target LeafWiki instance. Upon acquiring valid session credentials, the attacker crafts an HTTP request targeting the user update API endpoint associated with their own account. Within the payload of this request, the attacker modifies the account role parameter from the baseline role to an administrative designation such as admin.\nBecause the vulnerable component lacks proper access control enforcement to verify whether the requesting user possesses administrative privileges to alter sensitive account attributes, the backend application processes the request and persists the elevated role directly into the database. Consequently, the attacker's session is upgraded to administrative privileges.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a standard user. 2) The attacker intercepts or constructs an API request destined for the user update interface. 3) The attacker injects the administrative role parameter into the modification payload. 4) The server processes the update without validating authorization constraints against the requested role change. 5) The attacker achieves full administrative privilege escalation, enabling post-exploitation activities such as managing other users, modifying sensitive wiki pages, and accessing restricted system configurations."
}