CVE-2026-104443: YesWiki before 4.6.7 Scope Bypass via Triples Delete API
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated YesWiki user can exploit the affected triples delete API. No elevated privileges or user interaction are required.
What does an attacker need to do to trigger the authorization lockout?
The attacker can send an empty filter to the triples delete endpoint and remove the semantic triple representing admins-group membership. This can empty the admin group and cause site-wide authorization lockout.
Which deployments are affected?
YesWiki versions before 4.6.7 are affected. The issue is reachable through the triples delete API when an attacker has an authenticated account.
What is the security impact beyond deleting data?
An attacker can delete or forge arbitrary semantic triples regardless of ownership. This includes manipulating authorization-related triples, such as admins-group membership.