CVE-2026-43937 YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`
Low-privileged users can bypass authorization checks to execute arbitrary SQL commands via the admin RunSql endpoint in YAF.NET forums.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43937?
CVE-2026-43937 is a high-severity missing authorization vulnerability in YAFNET, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.
Which versions are affected by CVE-2026-43937?
2 open source packages ship an affected version, including YAFNET.Core.
| Package | Affected | Fixed in |
|---|---|---|
YAFNET.Core NuGet | All versions | 4.0.5 |
YAFNET.Core NuGet | All versions | 4.0.5 |
How do I fix CVE-2026-43937?
Upgrade YAFNET.Core to 4.0.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-43937 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43937 exists.
Sources
Also known as GHSA-xhw7-j96h-c3g5.