Security readout for executives and security teams
Plain-English summary
This CVE claims DokuWiki 2025-05-14b allows unauthenticated account creation through registration. The supplier disputes it, saying this is intended behavior only when administrators enable non-default self-registration. Treat it as a configuration exposure until stronger evidence shows a product flaw.
Executive priority
Do not treat this as automatically critical across all DokuWiki deployments. Prioritize internet-facing wikis where registration is enabled and new accounts receive meaningful access.
Technical view
The report maps to CWE-640 and assigns CVSS 9.8 for unauthenticated network access. Available source details identify the register function in inc/auth.php, but the vendor states self-registration is intentional when configured and not enabled by migration without administrator knowledge.
Likely exposure
Externally reachable DokuWiki instances running 2025-05-14b with self-registration enabled are the plausible exposure. Default installations or sites without public registration are not clearly affected based on the bundle.
Exploitation context
No KEV listing is provided, and the bundle does not show confirmed active exploitation. A public gist and GitHub issue are referenced, but the vendor dispute materially limits confidence in exploitability as a vulnerability.
Researcher notes
The central issue is disputed: reported as account creation via registration, but vendor frames it as expected behavior under a non-default setting. Validation should focus on configuration state, ACL impact, and whether any unauthorized privilege follows account creation.
Mitigation direction
- Check DokuWiki vendor issue 4682 for current guidance.
- Disable self-registration if public account creation is not required.
- Review ACLs for privileges granted to newly registered users.
- Monitor and review recently created accounts.
- Apply vendor updates if DokuWiki publishes a related fix or guidance.
Validation and detection
- Confirm the deployed DokuWiki version and configuration.
- Verify whether self-registration is enabled intentionally.
- Review account creation logs for unexpected registrations.
- Check default group permissions for new users.
- Document business need for any public registration setting.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-640: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-37106 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/dokuwiki/dokuwikiCVE reference, mitre
- https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1CVE reference, mitre
- https://github.com/dokuwiki/dokuwiki/issues/4682CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.