CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
Unauthenticated attackers can overwrite any wiki page, including protected ones, via the Bazar entry-creation flow, leading to mass defacement and content destruction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104449?
CVE-2026-104449 is a high-severity missing authorization vulnerability in yeswiki, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
Weakness: CWE-639
Which versions are affected by CVE-2026-104449?
How do I fix CVE-2026-104449?
No fix has been published for CVE-2026-104449 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104449 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104449 exists.
Sources
Also known as GHSA-4388-phmh-jrw8, GHSA-h2q6-cgj7-p65g.