CVE Intelligence
Analysis AI-assisted

CVE-2026-37106: DokuWiki: Account Creation via Registration Function (Disputed)

A reported issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account through the register function in inc/auth.php. The CNA record rates it critical with a CVSS 3.1 score of 9.8, but the supplier disputes it, stating the behavior is intentional when self-registration is enabled, a non-default setting. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-37106 describes a reported issue in DokuWiki 2025-05-14b "Librarian" 56.2 in which a remote attacker may create an account through the register function in inc/auth.php. The CNA record lists a CVSS 3.1 base score of 9.8 (critical). The supplier disputes the report, stating that account creation is intended behavior when self-registration is enabled, which is a non-default feature.

Impact

  • If self-registration is enabled, an unauthenticated remote user could obtain an account, which may grant access to features reserved for logged-in users depending on the wiki's permission settings.
  • The CVSS vector in the record describes network reachability, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability, as scored by the CNA.
  • Inference: the practical impact depends heavily on whether self-registration is enabled. The critical score may not reflect deployments where it is disabled.

Affected products and versions

  • The description names DokuWiki 2025-05-14b "Librarian" 56.2.
  • The record's affected list is empty, so no structured version range is available.
  • Unknown: whether other releases are affected.
  • The listed CWE is CWE-640 (Weak Password Recovery Mechanism). This does not obviously match an account-creation description, so the classification should be verified against the CNA and NVD records.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The record includes an EPSS probability, which is low.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists; check the DokuWiki repository for updates.
  • Until the position is clarified, administrators should confirm whether self-registration is enabled and disable it if it is not required.
  • Review user accounts and permission assignments, particularly accounts created recently.
  • Keep the wiki on supported releases and follow upstream guidance.

Detection guidance

  • Review the wiki's user list for accounts created outside administrative workflows.
  • Monitor web server logs for registration activity from unexpected sources, at a high level.
  • Check the self-registration setting after upgrades or migrations, even though the supplier states that migration does not enable it silently.

Limitations of the available information

  • The record is in "Awaiting Analysis" status.
  • The supplier dispute means the status of the issue is contested, and the record contains no independent verification of the behavior.
  • The record contains no affected or fixed version data, and the CWE mapping may not match the description.
  • The referenced gist is listed in the record, but its content was not relied upon.

Frequently asked questions

Is CVE-2026-37106 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Why is the severity disputed?

The supplier states that account creation is intended behavior when self-registration is enabled, which is a non-default setting, and that migrations do not enable it without administrators knowing.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.