CVE-2026-53527: CWE-269: Improper Privilege Management in perber leafwiki

CVE-2026-53527 is a privilege escalation vulnerability (CWE-269) in LeafWiki, a self-hosted wiki software. The flaw exists in the user update API, allowing an authenticated user to modify their own account role and escalate privileges from roles such as 'viewer' to 'admin'. This vulnerability affects LeafWiki versions from 0.1.0 up to but not including 0.10.1. Exploitation requires a valid authenticated user account. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The impact includes full confidentiality, integrity, and availability compromise. No known exploits in the wild are reported. The vendor recommends updating to version 0.10.1 or later and applying access restrictions as interim mitigations.

Successful exploitation allows an authenticated user to escalate their privileges to administrator level, potentially leading to full control over the LeafWiki instance. This compromises confidentiality, integrity, and availability of the wiki content and configuration. Instances that allow public registration or have untrusted users are at higher risk. Instances restricted to trusted users have a lower practical risk.

A fix is available in LeafWiki version 0.10.1 and later; users should update to this version to remediate the vulnerability. Until the patch is applied, operators should restrict account creation to trusted users only and, if possible, restrict access to the user update API to trusted users or administrators to prevent unauthorized privilege escalation.