CVE-2022-1681

Wiki.js has an authentication bypass using an alternate path or channel, and the payoff is stark: an attacker can obtain root user permissions on the wiki. Rather than defeating the login, the exploit takes a side route the auth logic doesn't guard, arriving at the highest privilege level. For a wiki platform — which typically holds internal documentation, runbooks, and often embedded secrets — administrative takeover is a serious confidentiality and integrity event.

An auth-bypass-to-admin in a self-hostable web app is the kind of bug that gets folded into scanning once a proof-of-concept circulates, since there's no credential barrier and the reward is complete control of the instance. What an attacker gains next is telling: wikis are treasure maps — network diagrams, credentials pasted into pages, onboarding docs — so root on the wiki is frequently a stepping stone to the rest of the environment, not just defacement of documentation. The version boundary, before 2.5.281, is the line between exposed and safe.

Our emphasis is internet-exposure and the downstream secrets problem. We'd find any Wiki.js below 2.5.281, prioritizing internet-reachable instances since those are directly takeable, and get them onto a fixed release. Because a wiki compromise so often leaks credentials stored in its pages, we'd also treat any exposed vulnerable instance as a reason to review and rotate secrets that live in it — patching closes the door, but if it was open, assume the contents were read.