CVE-2016-10026: ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites...

Security readout for executives and security teams

CVE-2016-10026 is an ikiwiki authorization bypass affecting specific sites using git, recentchanges, and the CGI interface. An attacker could revert certain page changes after permissions changed, undermining content integrity and access controls. Public sources do not show active exploitation or a CVSS score. Exposure appears limited to ikiwiki deployments with the git and recentchanges plugins plus CGI enabled. Organizations not running ikiwiki, or not using that configuration, are unlikely to be exposed based on the provided sources. Treat as a targeted integrity and authorization issue, not an internet-wide emergency. Prioritize if ikiwiki hosts sensitive documentation, customer-facing pages, or access-controlled content. Confirm exposure before broad response activity. Mitigation focus: Identify any ikiwiki deployments and their package source.; Review Debian and ikiwiki advisories for the corrected release path.; Upgrade using vendor-supported packages where applicable..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.