CVE-2015-2172: Dokuwiki

Medium severity, CVSS 6.5. EPSS: 2.9% chance of exploitation in the next 30 days.

DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.

Affected products

• Dokuwiki Dokuwiki: from 2014-05-05, before 2014-05-05d (fixed in 2014-05-05d); from 2014-09-29, before 2014-09-29c (fixed in 2014-09-29c)

Published 2015-03-30. Last modified 2026-06-17.