Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck
CVE-2026-104455YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
Medium 5.3
In plain English
A medium-severity information exposure in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-89vc-h4r4-h25q) vendor-advisory
- VulnCheck Advisory: YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action third-party-advisory