CVE-2026-53527

Name of the Vulnerable Software and Affected Versions LeafWiki versions 0.1.0 through 0.10.0

Description An authenticated user can escalate their privileges from a regular role, such as viewer, to admin by manipulating the user update API. This issue requires the attacker to possess a valid authenticated account. Instances that disable public registration and only allow trusted users are at lower risk.

Recommendations Update to version 0.10.1 or greater. Restrict account creation to ensure only trusted users have accounts. Restrict access to the user update API to trusted users or administrators only.