CVE-2026-37106

Katalog CVE

CVSS 9.8 · Critical EPSS 0,74%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

21 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1
• https://github.com/dokuwiki/dokuwiki
• https://github.com/dokuwiki/dokuwiki/issues/4682