Cross-Site Request Forgery in YesWiki Affects Administrator Capabilities
CVE-2026-116204

7.2HIGH

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116204?

YesWiki prior to version 4.7.0 is susceptible to a cross-site request forgery (CSRF) vulnerability within the 'despam' action of its tools/security/actions/despam.php script. This flaw permits unauthenticated attackers to delete or restore pages by exploiting an administrator's session. By embedding an auto-submitting raw HTML form into a wiki page, malicious actors can trick unsuspecting administrators into executing harmful actions, potentially leading to the loss of critical content and settings, including the deletion of essential pages such as PagePrincipale and configuration files.

Affected Version(s)

yeswiki 0 < 4.7.0

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0...
third-party-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.