CVE-2026-52766

Katalog CVE

CVSS 9.1 · Critical EPSS 0,58%

Kerentanan Incorrect Default Permissions. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

Rincian

Terbit di NVD

5 September 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions
CWE-862: Missing Authorization

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abef
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x