High severity7.5NVD Advisory· Published Feb 13, 2017· Updated Jun 17, 2026

CVE-2016-10026

Description

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ikiwiki/Ikiwiki2 versions
cpe:2.3:a:ikiwiki:ikiwiki:3.20161219:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ikiwiki:ikiwiki:3.20161219:*:*:*:*:*:*:*
- (no CPE)range: 3.20161219
osv-coords
pkg:rpm/opensuse/ikiwiki&distro=openSUSE%20Tumbleweed
Range: < 3.20200202.3-2.7

Patches

Vulnerability mechanics

References

ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/nvdIssue TrackingVendor Advisory
www.openwall.com/lists/oss-security/2016/12/21/3nvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2016/12/29/3nvdMailing ListThird Party Advisory
ikiwiki.info/security/nvdVendor Advisory
www.debian.org/security/2017/dsa-3760nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000