CVE-2026-104453: YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
YesWiki deployments running a version before 4.6.7 are exposed when an administrator can be induced to follow an attacker-crafted link. The attack relies on the administrator's authenticated cookie being sent with top-level navigation under SameSite=Lax behavior.
What does an attacker need to exploit it?
The attacker does not need credentials, but must lure an authenticated YesWiki administrator into opening a crafted GET link. The link can supply a broad id range through the delete_tag parameter.
What is the impact of successful exploitation?
An attacker can delete tag associations, including in bulk, by causing deletion of tag triples through the admintag action. The stated impact is limited to integrity and availability; no confidentiality impact is indicated.
What can be done if upgrading is not immediately possible?
The provided information identifies the affected action as admintag and the delete_tag GET parameter, but does not provide a documented workaround. Until an update is applied, administrators should avoid following untrusted links while authenticated to YesWiki.