CVE-2026-116821GHSA-q5j6-79p7-mp94
YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
YesWiki yeswiki
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.7.0yeswikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.
Text from CVE List
Affected versions 2
- yeswikiaffected: all versions before 4.7.0CVE List
- yeswikiunaffected: 4.7.0CVE List