DokuWiki Unauthorized User Registration Vulnerability Reproduction (CVE-2026-37106)

0x01 Vulnerability Overview

CVE ID: CVE-2026-37106
Affected Version: DokuWiki 2025-05-14b
Vulnerability Type: Incorrect Access Control (Unauthorized User Registration)

A potential misconfiguration risk exists in DokuWiki's registration functionality. When the self-registration feature is enabled (either via the legacy openregister setting or the modern register action), unauthenticated remote attackers can send crafted HTTP requests to create arbitrary user accounts. This behavior is consistent with the system's intended design, but may lead to unintended account creation if administrators are unaware that the feature is active.

0x02 Root Cause Analysis

2.1 Root Cause

The register() function in inc/auth.php is designed to handle self-registration requests. This function intentionally does not require existing authentication or a CSRF token, because it is designed for unauthenticated public users.

However, if an administrator is unaware that the self-registration feature is turned on (for example, due to a legacy configuration migration from openregister), it can result in unintended account creation on an otherwise private wiki.

2.2 Affected Code (Clarification)

function register()
{
global $lang;
global $conf;
/* @var AuthPlugin $auth */
global $auth;
global $INPUT;

if (!$INPUT->post->bool('save')) return false;
if (!actionOK('register')) return false;

// Note: This is a public endpoint for self-registration.
// No CSRF token or authentication checks are required by design.

$login = trim($auth->cleanUser($INPUT->post->str('login')));
// ... user creation logic ...
}

2.3 Impact of autopasswd Configuration

The exploitation method and subsequent impact depend on the autopasswd configuration:

Configuration: autopasswd=1 (Default)
Password Source: Auto-generated
Email Notification: Yes (with password)
Login Method: Retrieve via email
SMTP Dependency: Required

Configuration: autopasswd=0
Password Source: User-submitted
Email Notification: No
Login Method: Direct login
SMTP Dependency: Not required

When autopasswd=1 (default), the system ignores user-submitted passwords, auto-generates a random password, and sends it to the registered email. Attackers need access to that email to complete login. When autopasswd=0, the system directly uses the password submitted by the attacker, allowing immediate account takeover.

0x03 Environment Setup

Deploy DokuWiki 2025-05-14b in an isolated local environment, ensuring it is isolated from the internet.

Test Environment: http://[YOUR_LOCAL_IP]

0x04 Vulnerability Reproduction

4.1 Attack Vector

Send a POST request to the DokuWiki registration endpoint without any Cookie or Token validation.

4.2 HTTP Request Example

POST /doku.php HTTP/1.1
Host: [YOUR_LOCAL_IP]
Content-Type: application/x-www-form-urlencoded

do=register&save=1&login=attacker&pass=Password123&passchk=Password123&fullname=Attacker&email=attacker@test.com

Note: Replace [YOUR_LOCAL_IP] with your local test environment address (e.g., localhost:8080) when actually testing.

4.3 Reproduction Steps

1. Send registration request: Use Burp Suite or curl to send the above HTTP request
   

2. Verify account creation:

   • Response status code indicates successful registration
   • Check the conf/users.auth.php file to confirm the new user has been added
   • Sample output: attacker:$2y$10$...:Attacker Account:attacker@test.com:user
     

3. Login verification (autopasswd=0 scenario):

   • Log in using the submitted password Password123
   • Login successful, regular user privileges obtained
     

4.4 Configuration Difference Verification

Configuration: autopasswd=0
Reproduction Result: Attacker can log in immediately with submitted password

Configuration: autopasswd=1
Reproduction Result: Account creation succeeds, login depends on email configuration

0x05 Vulnerability Impact

• Unauthorized attackers can bulk-create accounts, consuming system resources
• Created regular user accounts can be used for subsequent social engineering attacks
• Can be combined with other vulnerabilities for privilege escalation
• Potential spam account creation risk

0x06 Remediation Recommendations

6.1 Configuration Hardening (Best Practices)

Instead of modifying core code, administrators should adopt the following configuration practices:
Disable registration if not needed: Explicitly add register to the disabled actions list in the configuration manager.
If registration is required, install a CAPTCHA plugin to prevent automated account creation.
Enable Access Control Lists ($conf['useacl'] = 1) and ensure SMTP is configured correctly.
Log registration attempts for security auditing.

0x07 Conclusion

This issue has been successfully verified in a local test environment. When self-registration is enabled, unauthenticated attackers can create user accounts through the registration endpoint. The autopasswd configuration determines password generation and subsequent login behavior: when autopasswd=0, attackers can log in immediately; when autopasswd=1, exploitation depends on email configuration.