CVE-2026-104453 — YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to craf…
Published: 2026-10-02 · CVSS: 5.3 · CVSS 4.0
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7