CVE-2026-104451

MEDIUM 4.3

YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.

CWE	CWE-352
Vendor	yeswiki
Product	yeswiki
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for yeswiki yeswiki

Be the first to know when new medium vulnerabilities affecting yeswiki yeswiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

YesWiki / yeswiki

0 < 4.6.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-vj5g-974q-7ff3 vulncheck.com: https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-csrf-page-revision-restore-via-revisionshandler

Credits

🔍 manus-use