CVE-2026-37106

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-37106
An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1
https://github.com/dokuwiki/dokuwiki
https://github.com/dokuwiki/dokuwiki/issues/4682
https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1
Configurations

No configuration.

History

15 Jul 2026, 20:16

Type Values Removed Values Added
Summary (en) An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). (en) An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.

01 Jul 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-640
References () https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1 - () https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1 -

01 Jul 2026, 15:17

Type Values Removed Values Added
References
  • () https://github.com/dokuwiki/dokuwiki/issues/4682 -
Summary (en) An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to execute arbitrary code via the register function in inc/auth.php (en) An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature).

30 Jun 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-30 22:16

Updated : 2026-07-21 17:17

NVD link : CVE-2026-37106

Mitre link : CVE-2026-37106

CVE.ORG link : CVE-2026-37106

JSON object : View

Products Affected

No product.

CWE
CWE-640

Weak Password Recovery Mechanism for Forgotten Password