CVE-2026-37106

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.

Published 2026-06-30. Last modified 2026-07-21.