CVE-2026-104443

HIGH 8.1

YesWiki before 4.6.7 Scope Bypass via Triples Delete API

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.

CWE	CWE-863
Vendor	yeswiki
Product	yeswiki
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for yeswiki yeswiki

Be the first to know when new high vulnerabilities affecting yeswiki yeswiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

YesWiki / yeswiki

0 < 4.6.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9j7h-ccj2-jxv6 vulncheck.com: https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-scope-bypass-via-triples-delete-api