PT-2026-125526
CVE-2026-116821
·
Published
2026-10-26
·
Updated
2026-10-27
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the and % wildcards. Self-registered attackers can use usernames such as or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.
Found an issue in the description? Have something to add? Feel free to write us 👾