CVE-2016-10026
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a...
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
CVE-2016-10026- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
CVE-2016-10026- Updated
- 2026-11-02
EUVDEUVD-2016-1223 No score
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
EUVD-2016-1223- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r7m6-q359-fprm
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a...
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
GHSA-r7m6-q359-fprm- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
CVE-2016-10026- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10026
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
DEBIAN-CVE-2016-10026- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10026
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
- Record
UBUNTU-CVE-2016-10026- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0113 No score
Updated ikiwiki packages fix security vulnerability
Several security issues identified in ikiwiki fixed by updating to version 3.20190228. See references for details
- Record
MGASA-2019-0113- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10860-1 No score
ikiwiki-3.20200202.3-2.7 on GA media
These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10860-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ikiwikiDebian:12 |
before 3.20161219 | 3.20161219 |
ikiwikiDebian:13 |
before 3.20161219 | 3.20161219 |
ikiwikiDebian:14 |
before 3.20161219 | 3.20161219 |
ikiwikiDebian:7 |
before 3.20120629.2+deb7u2, plus listed versions 3.201206293.20120629.13.20120629.23.20120629.2+deb7u1 |
3.20120629.2+deb7u2 |
ikiwikiDebian:8 |
before 3.20141016.4, plus listed versions 3.20141016.23.20141016.3 |
3.20141016.4 |
ikiwikiMageia:6 |
before 3.20190228-1.1.mga6 | 3.20190228-1.1.mga6 |
ikiwikiUbuntu:16.04:LTS |
All versions, plus listed versions 3.201506143.20160121 |
None known |
ikiwikiopenSUSE:Tumbleweed |
before 3.20200202.3-2.7 | 3.20200202.3-2.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10026 is a high vulnerability (CVSS 7.5) in Ikiwiki, published January 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in ikiwiki 3.20161219.
References
ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed
debian.org/security/2017/dsa-3760
openwall.com/lists/oss-security/2016/12/21/3
nvd.nist.gov/vuln/detail/CVE-2016-10026
Show 26 moreShow less
github.com/advisories/GHSA-r7m6-q359-fprm
security-tracker.debian.org/tracker/CVE-2016-10026
advisories.mageia.org/MGASA-2019-0113.html
bugs.mageia.org/show_bug.cgi?id=24453
ubuntu.com/security/CVE-2016-10026
cve.org/CVERecord?id=CVE-2016-10026
suse.com/security/cve/CVE-2008-0169