CVE-2026-37106: DokuWiki Unauthorized User Registration Vulnerability

cve-2026-37106.md

[CVE-ID] CVE-2026-37106

[PRODUCT] DokuWiki 2025-05-14b

[TYPE] Incorrect Access Control (Unauthorized User Registration)

[DESCRIPTION] An unauthorized user registration vulnerability exists in DokuWiki. Attackers can create user accounts without any authentication by sending crafted HTTP requests to the registration endpoint. This vulnerability bypasses both CSRF protections and access control mechanisms.

[DETAILS] The vulnerability resides in the register() function located in inc/auth.php. The root cause is that this function lacks the following critical security checks when processing registration requests:

1. Missing CSRF token validation: Fails to prevent cross-site request forgery attacks.
2. Missing authentication check: Allows any unauthenticated user to call this function and create accounts.

The exploitation method and subsequent impact depend on the autopasswd configuration:

• When autopasswd=1 (default), the system ignores user-submitted passwords, auto-generates a random password, and sends it to the registered email. Attackers need access to that email (or exploit misconfigured mail settings) to complete login, but account creation itself is not hindered.
• When autopasswd=0, the system uses the password submitted by the attacker in the request. Attackers can immediately log in with the submitted password, achieving instant and complete account takeover.

Reproduction Steps (verified in a local test environment):

1. Send the following POST request to the registration endpoint (no Cookie or Token required):

   POST /doku.php HTTP/1.1
   Host: [YOUR_LOCAL_TEST_HOST]
   Content-Type: application/x-www-form-urlencoded
   
   do=register&save=1&login=attacker&pass=Password123&passchk=Password123&fullname=Attacker&email=attacker@test.com

[Mitigation & Fix Recommendations]

1. Code Fix: Add if (!checkSecurityToken()) return false; to the register() function before processing registration logic to enforce CSRF protection. Optionally, add authentication checks as needed (e.g., if (!isset($_SERVER['REMOTE_USER'])) return false;).

2. Configuration Hardening: Enable Access Control Lists ($conf['useacl'] = 1). Properly configure email services to ensure password reset and recovery functions work. Consider implementing CAPTCHA for the registration form to prevent automated attacks. Log all registration attempts for security auditing.

[MORE] https://www.cnblogs.com/blimey/articles/20794218

Self signup/self registration is a documented feature of DokuWiki which is disabled in the default install.