CVE-2026-104439: YesWiki before 4.6.7 User Enumeration via Lost-Password Flow
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can submit email addresses to the MotDePassePerdu password-recovery page. No prior account or user interaction is required.
What information can an attacker obtain?
The differing password-recovery responses allow an attacker to determine whether a submitted email address is registered. The issue exposes account existence, not passwords or account access directly.
Are default deployments affected?
Deployments running YesWiki before 4.6.7 are affected where the MotDePassePerdu recovery page is accessible. The provided information does not identify any configuration prerequisite beyond access to that flow.
What can be done before upgrading?
The described attack relies on unrestricted submissions to the password-recovery page. If an upgrade cannot be applied immediately, restrict access to that flow or add rate limiting, and treat password-reset responses consistently so they do not reveal whether an email is registered.