CVE-2026-104438 — YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-AC…
Published: 2026-10-02 · CVSS: 8.7 · CVSS 4.0
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7