Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104449YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.6.7

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

References

GitHub Security Advisory (GHSA-4388-phmh-jrw8) vendor-advisory
VulnCheck Advisory: YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche third-party-advisory