CVE-2015-2172: DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins,...

Security readout for executives and security teams

Older DokuWiki releases had an access-control flaw in the XML-RPC path. An authenticated remote user could gain higher privileges by adding or deleting ACL rules. This matters most where DokuWiki is used for internal documentation, customer portals, or operational runbooks with sensitive permissions. Exposure is likely limited to DokuWiki deployments running versions older than 2014-05-05d or 2014-09-29c, especially where XML-RPC is enabled and reachable by authenticated users. Treat as a scheduled remediation item unless the wiki contains sensitive data or broad authenticated access exists. Prioritize faster if DokuWiki supports business-critical documentation, regulated content, or customer-facing collaboration. Mitigation focus: Upgrade DokuWiki to 2014-05-05d, 2014-09-29c, or a later maintained release.; Review DokuWiki change notes and downstream Fedora or Mageia advisories for package-specific updates.; Restrict XML-RPC exposure to required trusted users while upgrade work is completed..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.