CVE-2026-104438

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description An authorization flaw exists in the tags tool within the listpagestag and includepages actions. These actions enumerate pages without applying read-ACL (Access Control List) filtering, which is a mechanism used to restrict access to specific pages based on user permissions. Unauthenticated or unprivileged attackers can embed these actions using a specific tag or page name to disclose the names and body-derived titles of pages that are restricted by ACLs.

Recommendations Update YesWiki to version 4.6.7 or later.