CVE-2026-104455: YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it over the network. No credentials or user interaction are required.
What content can be exposed?
The XML method of a page hosting the recentchangesrssplus action can return 500-character body excerpts for every latest page. This can include pages protected by read ACLs, such as restricted drafts and notes.
How can I determine whether my instance is exposed?
Instances running a YesWiki version before 4.6.7 are affected if they host a page using the recentchangesrssplus RSS action. Requesting that page's XML method may reveal excerpts from recent restricted pages.
What can be done if upgrading is not immediately possible?
The available information identifies the recentchangesrssplus RSS action and its XML method as the exposure path. Restricting access to or removing pages that host this action can reduce exposure until the instance is updated to 4.6.7 or later.