LeafWiki, a self-hosted wiki software, has a privilege escalation vulnerability (CWE-269) in versions 0.1.0 through 0.10.0. The flaw exists in the user update API, allowing authenticated users to modify their own account roles and escalate privileges to admin level. This vulnerability requires the attacker to have a valid authenticated user account. The vulnerability is tracked as CVE-2026-53527 with a CVSS 3.1 score of 8.8, indicating high severity. No official patch advisory or vendor remediation level is explicitly stated, but updating to version 0.10.1 or greater is recommended by the source. Mitigations include restricting account creation and limiting access to the user update API to trusted users or administrators.

An authenticated user can escalate their privileges from a regular user role such as 'viewer' to an administrator role, potentially gaining full control over the LeafWiki instance. This could lead to unauthorized access, modification, or deletion of wiki content and administrative functions. Instances that do not allow public registration and only have trusted users are at lower practical risk.

Users should update LeafWiki to version 0.10.1 or later where the vulnerability is fixed. Until the update can be applied, operators should restrict account creation to trusted users only and, if possible, restrict access to the user update API to trusted users or administrators to prevent unauthorized privilege escalation.