CVE-2024-45298

Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me reset my password, but after resetting my password I can get into the wiki I was locked out of. The ramifications of this bug is a user can **bypass an account disabling by requesting their password be reset**. All users of wiki.js version `2.5.303` who use any account restrictions and have disabled user are affected. This issue has been addressed in version 2.5.304 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-670

• https://github.com/requarks/wiki/commit/b9fb17d4d4a0956ec35e8c73cc85192552fb8d16
• https://github.com/requarks/wiki/security/advisories/GHSA-vwww-c5vg-xgfc

Published

Sep 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45292PHPSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2024-45293PHPSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2024-45294The HL7 FHIR Core Artifacts repository provides the java cor…8.6
• CVE-2024-45295Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45296path-to-regexp turns path strings into a regular expressions…7.5
• CVE-2024-45297Discourse is an open source platform for community discussio…4.3
• CVE-2024-45299alf.io is an open source ticket reservation system for confe…6.5
• CVE-2024-4530The Business Card WordPress plugin through 1.0.0 does not ha…6.3
• CVE-2024-45300alf.io is an open source ticket reservation system for confe…5.9
• CVE-2024-45301Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In …5.3
• CVE-2024-45302RestSharp is a Simple REST and HTTP API Client for .NET. The…7.8
• CVE-2024-45303Discourse Calendar plugin adds the ability to create a dynam…6.1