Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-30T00:00:00 DokuWiki: DokuWiki: Unauthorized account creation via registration function 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-306

An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.

A flaw was found in DokuWiki. A remote attacker can create an account through the registration function. This occurs when the DokuWiki instance is configured to allow self-registration, which is not the default setting. This could lead to the creation of unauthorized user accounts.

This flaw in DokuWiki is rated as Low impact because it only affects instances configured for self-registration, which is not the default setting in Red Hat deployments. An attacker could create unauthorized user accounts if this non-default feature is enabled. To mitigate this issue, ensure that the self-registration feature in DokuWiki is disabled if not explicitly required. This can typically be controlled within the DokuWiki configuration settings. Consult the DokuWiki documentation for specific instructions on managing user registration settings. If the DokuWiki service is reloaded or restarted after configuration changes, verify the setting has taken effect. https://www.cve.org/CVERecord?id=CVE-2026-37106 https://nvd.nist.gov/vuln/detail/CVE-2026-37106 https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1 https://github.com/dokuwiki/dokuwiki https://github.com/dokuwiki/dokuwiki/issues/4682