CVE-2026-116821: YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the and % wildcards. Self-registered attackers can use usernames such as or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs only a self-registered YesWiki account and network access to the affected instance. No user interaction is required.
What data could be exposed?
The bypass can allow reading pages and Bazar entries whose read access is restricted to other users or groups. The exposed content can be retrieved through the public Bazar listing API.
Which deployments are affected?
YesWiki versions before 4.7.0 are affected where restricted pages or Bazar entries use read ACLs. The issue relies on usernames containing SQL LIKE wildcard characters, such as _ or %.
How can administrators identify potential exploitation or exposure?
Review registered usernames for SQL LIKE wildcard characters, particularly names made up of or containing _ and %. Also identify restricted pages and Bazar entries exposed through the public Bazar listing API.
What should be done if an immediate upgrade is not possible?
The provided information does not specify a workaround. As an interim risk-reduction measure, review and remove or restrict accounts with usernames containing _ or %, and limit exposure of the public Bazar listing API where possible.