CVE-2026-92774 describes an incorrect authorization vulnerability in Wiki.js through version 2.5.314. The issue arises because page tags are omitted from authorization checks in multiple GraphQL resolvers, including list, tree, tags, searchTags, and links. As a result, attackers can query these resolvers to access restricted page metadata that should be protected by tag-based access restrictions. This flaw allows unauthorized information disclosure of page metadata without requiring elevated privileges or user interaction.

The vulnerability enables unauthorized users with limited privileges to bypass tag-based access controls and retrieve restricted page metadata such as titles, descriptions, paths, and tag information. This leads to information disclosure but does not directly allow modification or deletion of content. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to GraphQL endpoints and monitor for suspicious queries that may attempt to exploit this authorization bypass. Avoid exposing sensitive metadata through these resolvers where possible.