CVE-2008-6603: MoinMoin Access Restrictions Bypassed due to improper ACL enforcement
Summary
CVE-2008-6603: MoinMoin Access Restrictions Bypassed due to improper ACL enforcement. Affects moin across 2 version ranges.
< 1.6.3
>= 1.7, < 1.7.1
Fixed in 1.6.3 or 1.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- moin · Debian:10
The same CVE-2008-6603 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin versions 1.6.2 and 1.7 are affected by a vulnerability that allows remote attackers to bypass access restrictions. This vulnerability occurs when the 'acl_hierarchic' setting is enabled. The improper enforcement of ACL checks can lead to unauthorized access to restricted content.
Vulnerability Detail
The vulnerability in MoinMoin arises from the improper enforcement of ACL checks when the 'acl_hierarchic' setting is enabled. This allows remote attackers to bypass intended access restrictions. By exploiting this vulnerability, an attacker can gain unauthorized access to restricted content, potentially exposing sensitive information or modifying the wiki's content. It is important to note that this vulnerability is different from CVE-2008-1937.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.31.6.3pip install --upgrade "moin==1.6.3" -
>= 1.7, < 1.7.11.7.1pip install --upgrade "moin==1.7.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the patched versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in MoinMoin allows remote attackers to bypass access restrictions and gain unauthorized access to restricted content. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of MoinMoin as mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing.
MoinMoin versions 1.6.2 and 1.7 are affected by this vulnerability.
This vulnerability allows remote attackers to bypass access restrictions and gain unauthorized access to restricted content in MoinMoin wikis.
There are no known exploits available for this vulnerability at the moment.
To fix this vulnerability, upgrade to the patched versions of MoinMoin: version 1.6.3 for MoinMoin 1.6.2 and version 1.7.1 for MoinMoin 1.7.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
