CVE-2026-104456: YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to self-register a YesWiki account and choose a username containing a double-quote SQL injection payload. No administrator privileges or user interaction are required.
When is the malicious username triggered?
The payload is stored at registration and is later used when a non-admin ACL-filtered listing is loaded. This makes the issue second-order: registration stores the payload, while a later listing request triggers the vulnerable query.
What could an attacker gain?
A successful exploit can expose database contents and bypass read ACL restrictions. The provided severity vector also indicates high confidentiality impact, with low integrity and availability impact.
Are default deployments affected?
The provided information identifies exposure when self-registration is available and non-admin ACL-filtered listings are used. It does not state whether those conditions are enabled by default.