PT-2026-104249

CVE-2026-104439

Published

2026-10-02

Updated

2026-10-02

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description An issue in LostPasswordAction.php allows unauthenticated attackers to confirm registered email addresses by analyzing differing server responses. This occurs on the MotDePassePerdu recovery page, which lacks rate limiting, enabling attackers to identify valid accounts for targeted phishing or password-spraying attacks.

Recommendations Update YesWiki to version 4.6.7 or later.

Exploitability

Exploit

Fix

Researchers

Skeletonsec

Vendors

Affected products

Weakness enumeration

CWE-204: Observable Response Discrepancy

Related identifiers

CVE-2026-104439