YesWiki: Missing authorization in tags actions discloses restricted page names
Summary
YesWiki before 4.6.7 does not apply read-ACL filtering in the listpagestag and includepages actions of the tags tool. An unauthenticated or unprivileged visitor who can embed these actions can list the names and body-derived titles of pages that are restricted to certain users, such as admin-only pages. According to the advisory, page content stays protected in the default template, but the CVE record rates the impact as high (CVSS 8.7), while the GitHub advisory rates it as low.
Affected
- YesWiki versions before 4.6.7 (affected range 0 to < 4.6.7)
Fixed in
- Update YesWiki to version 4.6.7 or later.
Workaround
- Unknown.
Exploitation
- CISA SSVC: exploitation status "poc", automatable: yes, technical impact: partial.
- The advisory describes a proof of concept using a crafted listpagestag or includepages call.
Our recommendation
- Update all YesWiki installations to version 4.6.7 or later.
- Check whether restricted pages contain sensitive titles, and rename or move them if needed.
- Review web server logs for requests to listpagestag or includepages from unauthenticated sessions.
- Restrict page ACLs and tag usage where possible until the update is applied.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hx4v-hjvg-9p6w github.com
- VulnCheck advisory: YesWiki before 4.6.7 Information Disclosure www.vulncheck.com
- OSV: CVE-2026-104438 osv.dev
- Vulners VulnRichment: CVE-2026-104438 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:01.
Original description (NVD)
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.