{
  "affected": [
    {
      "affectedData": [
        {
          "product": "leafwiki",
          "vendor": "perber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.10.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as `viewer`, to `admin`. Exploitation requires a valid authenticated LeafWiki user account. Instances without public registration and with only trusted users are at lower practical risk. Users should update to version 0.10.1 or greater. Until a patch is available, operators should restrict account creation and ensure that only trusted users have accounts on affected LeafWiki instances. If possible, access to the user update API should be restricted to trusted users or administrators only."
    },
    {
      "lang": "es",
      "value": "LeafWiki es una wiki autoalojada. Las versiones 0.1.0 a la 0.10.0 tienen una vulnerabilidad de escalada de privilegios en la API de actualizaci\u00f3n de usuarios. Un usuario autenticado podr\u00eda actualizar el rol de su propia cuenta y escalar privilegios de un usuario regular, como \u0027viewer\u0027, a \u0027admin\u0027. La explotaci\u00f3n requiere una cuenta de usuario de LeafWiki v\u00e1lida y autenticada. Las instancias sin registro p\u00fablico y con solo usuarios de confianza tienen un riesgo pr\u00e1ctico menor. Los usuarios deben actualizar a la versi\u00f3n 0.10.1 o superior. Hasta que un parche est\u00e9 disponible, los operadores deben restringir la creaci\u00f3n de cuentas y asegurarse de que solo usuarios de confianza tengan cuentas en las instancias de LeafWiki afectadas. Si es posible, el acceso a la API de actualizaci\u00f3n de usuarios debe restringirse solo a usuarios de confianza o administradores."
    }
  ],
  "id": "CVE-2026-53527",
  "lastModified": "2026-10-12T16:10:00.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53527",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-24T18:47:49.546223Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T22:16:39.147",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/perber/leafwiki/security/advisories/GHSA-jj4r-587p-r5h5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}