EUVD-2026-110528

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the and % wildcards. Self-registered attackers can use usernames such as or %%% that over-match ACL tokens, reading pages and Bazar entries...

CVE-2026-116821

YesWiki versions prior to 4.7.0 are vulnerable to a read-ACL bypass in the AclService::updateRequestWithACL function. The root cause is the failure to escape _ and % wildcards when interpolating usernames into SQL LIKE patterns . An attacker with self-registration capabilities can use specific us...

PT-2026-111606

Name of the Vulnerable Software and Affected Versions obsidian-tc versions prior to 1.3.1 Description Read access-control list ACL checks use a lexical vault-relative path, whereas containment checks use the resolved path. This discrepancy allows an in-vault symlink located under an allowed glob ...

CVE-2026-77361: Improper Link Resolution Before File Access

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list ACL checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied...

CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin...