CVE-2026-52766

🗓️ 04 Sep 2026 23:40:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 79 Views🌐 WEB

Unauthenticated arbitrary page deletion in YesWiki prior to 4.6.6 via erasespamedcomments action.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-52766	9 Jul 202621:48	–	circl
Cvelist	CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action	4 Sep 202623:40	–	cvelist
EUVD	EUVD-2026-71799	4 Sep 202623:40	–	euvd
Github Security Blog	YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action	9 Jul 202620:57	–	github
Mend	CVE-2026-52766	4 Sep 202623:40	–	mend
NVD	CVE-2026-52766	5 Sep 202600:17	–	nvd
osv_ghsa	GHSA-6X7X-GCMF-7R8X YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action	9 Jul 202620:57	–	osv_ghsa
Positive Technologies	PT-2026-57027	9 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-52766: Incorrect Default Permissions	5 Sep 202600:00	–	rapid7
Snyk	Missing Authorization	9 Jul 202620:57	–	snyk

Vulners

Node

yeswiki yeswikiRange<4.6.6

[
  {
    "vendor": "YesWiki",
    "product": "yeswiki",
    "versions": [
      {
        "version": "< 4.6.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abef
github	www.github.com/YesWiki/yeswiki/releases/tag/v4.6.6
github	www.github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x

Parameter	Position	Path	Description	CWE
suppr[]	request body	/{{erasespamedcomments}}	The {{erasespamedcomments}} wiki action fails to perform authorization checks, allowing users with page write access to delete arbitrary wiki pages by providing a list of tags in the suppr[] array.	CWE-276, CWE-862

09 Sep 2026 17:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.1

EPSS0.00579

SSVC