CVE-2026-104438: YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users and users without privileges can exploit it. They do not need valid access to the ACL-restricted pages whose information is disclosed.
What must an attacker do to trigger the disclosure?
The attacker must embed the listpagestag or includepages action from the tags tool and supply a chosen tag or page name. These actions can then enumerate pages without enforcing read ACLs.
What information can be exposed?
The issue exposes the names and body-derived titles of pages that are restricted by read ACLs. The provided information does not indicate that full page contents are disclosed.
Are default deployments affected?
The data identifies affected YesWiki versions before 4.6.7, but does not state whether the vulnerable actions are enabled or reachable in a default deployment.