CVE-2026-104446
MediumCVSS 6.5Summary
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient, sender, subject and body for spam and phishing.
Risk Assessment
The organization may be used to distribute spam and phishing from its SMTP server, which can harm reputation and lead to domain blacklisting.
Recommendation
Update YesWiki to version 4.6.7 or later to fix the authentication bypass in the mail handler.
Other vulnerabilities in YesWiki
See all- CVE-2026-104472High
Missing authorization in the attachment download handler in YesWiki before 4.6.7 allows unauthenticated attackers to bypass page read ACLs. They can retrieve confidential attachments from read-restricted pages by knowing the page tag and file parameter.
- CVE-2026-104471High
Unrestricted file upload in YesWiki before 4.6.7 allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. They can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
- CVE-2026-104468Medium
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability because password reset tokens lack expiry timestamps. An attacker who obtains an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.
- CVE-2026-104467High
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.
- CVE-2026-104466Medium
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php. Users who can edit pages or post comments can inject event handlers by placing quotes in markdown image URLs, leading to JavaScript execution in viewers' browsers, including administrators.
- CVE-2026-104464High
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.
- CVE-2026-104463High
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
- CVE-2026-104462High
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
- CVE-2026-104460High
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
- CVE-2026-104459Medium
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. An attacker can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
Original NVD description (English source)
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient, sender, subject and body for spam and phishing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS