CVE-2026-37106: An issue in DokuWiki 2025-05-14b "Librarian" 56

Synopsis

An authentication bypass (or unauthorized account creation) vulnerability affects DokuWiki 2025-05-14b "Librarian" 56.2. The issue is reachable over the network with no authentication required and no victim interaction needed, allowing a remote attacker to create arbitrary accounts via the self-registration endpoint in inc/auth.php. Successful exploitation grants the attacker a foothold as a registered user, enabling further access to wiki content, data, and functionality gated behind authentication. Note that the supplier disputes this as a vulnerability, asserting the behavior is intentional when self-registration is enabled, which is a non-default configuration. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the DokuWiki service over the network; the vulnerable registration endpoint is exposed via HTTP/HTTPS.

• AuthenticationNot required

  No credentials or existing account are needed; the registration endpoint is accessible to unauthenticated users by design when self-registration is enabled.

• Victim interactionNot required

  The attacker completes the attack entirely on their own without any action required from a legitimate user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment.

Blast Radius

• A successful attacker creates a valid authenticated account on the DokuWiki instance, bypassing any access controls that depend on registration being closed.
• With a registered account, the attacker can read wiki pages and stored content that are restricted to authenticated users, exposing confidential documentation.
• The attacker can modify or create wiki pages as a registered user, tampering with persisted content and potentially injecting malicious material.
• Depending on DokuWiki plugin configuration and ACL rules, the attacker may escalate further by exploiting features available only to registered users.