CVE-2026-104446GHSA-36fx-49jj-57rw
YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
YesWiki yeswiki
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 2 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.6.7yeswikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient, sender, subject and body for spam and phishing.
Text from CVE List
Affected versions 2
- yeswikiaffected: all versions before 4.6.7CVE List
- yeswikiunaffected: 4.6.7CVE List