CVE-2026-104444: YesWiki before 4.6.7 Authorization Bypass via Comments API editComment
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege YesWiki user can exploit it. No user interaction is required, and the attack can be performed over the network.
What access does an attacker need to modify protected content?
The attacker needs an account and the ability to send a POST request to the api/comments endpoint. By supplying a page they control as the pagetag field while targeting another tag, they can bypass per-page write ACLs.
What is the impact of successful exploitation?
An attacker can overwrite arbitrary pages or comments, including content protected by per-page write permissions. They can also reparent existing pages or comments.
Which versions are affected?
YesWiki versions before 4.6.7 are affected. The provided information identifies 4.6.7 as the version boundary for this issue.