Vulnerabilidad · Publicado 21/08/2026 · Actualizado 22/08/2026
LeafWiki, plataforma wiki autohospedada, contiene una vulnerabilidad de escalada de privilegios (CVSS 8.8) en su API de actualización de usuarios. Un atacante autenticado puede modificar su rol y escalar permisos de usuario regular a administrador, comprometiendo el control de acceso de la instancia. El riesgo es alta para empresas en LATAM que usan LeafWiki como repositorio interno de conocimiento sin restricciones de registro público.
LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as `viewer`, to `admin`. Exploitation requires a valid authenticated LeafWiki user account. Instances without public registration and with only trusted users are at lower practical risk. Users should update to version 0.10.1 or greater. Until a patch is available, operators should restrict account creation and ensure that only trusted users have accounts on affected LeafWiki instances. If possible, access to the user update API should be restricted to trusted users or administrators only.
Score: 8.8/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269
Publicado en NIST NVD.