CVE-2026-52766

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6

Description An issue exists in the {{erasespamedcomments}} wiki action, located in actions/EraseSpamedCommentsAction.php, which allows unauthenticated users to permanently delete arbitrary wiki pages. The action processes a suppr[] array from a POST request and deletes every page whose tag is listed without performing authorization, ownership, or CSRF checks. This is exacerbated by an allow-by-default ACL model where default write acl='*' on fresh installations, granting write access to anonymous users.

The process involves the PageController::delete() function and the PageManager::deleteOrphaned() function. Despite its name, deleteOrphaned() does not verify if a page is orphaned and instead executes unconditional DELETE operations across the pages, links, acls, triples, referrers, and tags database tables. An attacker can exploit this by creating a trigger page and sending a POST request with the clean=yes parameter and the suppr[] array containing the tags of the target pages, such as the front page or admin pages.

Recommendations Upgrade YesWiki to version 4.6.6. As a temporary workaround, restrict access to the {{erasespamedcomments}} action or modify the default write acl configuration to prevent anonymous users from having write access.