The Wiki.js GraphQL mutation users.update in versions prior to 2.5.313 accepts an arbitrary list of group identifiers and applies them to a user account without validating the group IDs or the caller’s ownership. A user who holds the manage:users permission—typically a moderator—can assign themselves the Administrators group by submitting groups:[1]. Once re‑authenticated, the resulting JSON Web Token contains manage:system, granting unrestricted administrative control over the entire wiki site in a single mutation.

Requarks Wiki.js releases 2.5.312 and earlier are susceptible. The issue was resolved in version 2.5.313, which added validation to the users.update mutation.

With a CVSS score of 8.6, the vulnerability poses high severity. No EPSS score is available and the flaw is not yet listed in the CISA KEV catalog, suggesting it may not be widely exploited at present. However, a legitimate moderator can trigger the escalation by invoking the mutation, so threat exposure exists internally once manage:users has been granted. The absence of group ID checks means any user with moderate rights can elevate to site administrator if they are able to submit the mutation. The damage from exploitation would be comprehensive loss of confidentiality, integrity, and availability across the wiki environment.