VaultWiki Security Update: September 2022

As of September 9, security patches for September 2022 are now available.

Issue List

VWE-2022-6458 is a Permissions Escalation issue, where a user can change tags for a wiki page even though they don't have permissions to tag that page, as long as they know the URL for the page's tag editor and have permissions to change the page's categories. The issue affects VaultWiki 4.1.3 and higher. Prior to 4.1.3, there was no separate permission for changing tags.

Patches

The following patches address the aforementioned issue:

• 4.1.5 Patch Level 2
• 4.1.4 Patch Level 3
• 4.1.3 Patch Level 6

Notes

We highly recommend that all users running VaultWiki in a production environment update to a patched release as soon as they are able.