CVE-2026-104449
YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
| CWE | CWE-639 |
| Vendor | yeswiki |
| Product | yeswiki |
| Published | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for yeswiki yeswiki
Be the first to know when new medium vulnerabilities affecting yeswiki yeswiki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
YesWiki / yeswiki
0 < 4.6.7
References
Credits
🔍 manus-use