CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

EUVD-2026-91450

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL always returns true, attackers can supply internal URLs fetche...

EUVD-2026-91449

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104440 YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL always returns true, attackers can supply internal URLs fetche...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439

YesWiki versions prior to 4.6.7 are vulnerable to a user enumeration vulnerability within the LostPasswordAction.php component. Unauthenticated attackers can confirm registered email addresses by submitting emails to the MotDePassePerdu recovery page and analyzing the differing responses. The lac...

CVE-2026-104440

Versions of YesWiki prior to 4.6.7 are vulnerable to a blind server-side request forgery (SSRF) . The flaw exists because the isValidURL() function always returns true, allowing unauthenticated attackers to supply internal URLs via the idtypeannonce parameter of the /api/entries/bazarlist endpoin...

CVE-2026-104440 YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL always returns true, attackers can supply internal URLs fetche...

CVE-2026-104438

YesWiki versions before 4.6.7 are susceptible to a missing authorization vulnerability within the listpagestag and includepages actions of the tags tool. The root cause is the failure to apply read-ACL filtering , which allows unauthenticated or unprivileged attackers to enumerate pages. By embed...

CVE-2026-104438 YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

CVE-2026-104438 YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

EUVD-2026-91448

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

CVE-2026-104438 YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

PT-2026-104250

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL always returns true, attackers can supply internal URLs fetche...

CVE-2026-104467: Missing Authorization

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

CVE-2026-104464: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

PT-2026-104257

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

PT-2026-104274

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

PT-2026-104262

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104458: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...