This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10026 →

DEBIAN-CVE-2016-10026

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and...

Original description

The description as published by the source.

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ikiwiki

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20161219"}]}]

Debian:13 ikiwiki

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20161219"}]}]

Debian:14 ikiwiki

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20161219"}]}]

References

advisory security-tracker.debian.org