Is CVE-2026-116204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116204 being exploited in the wild.

How severe is CVE-2026-116204?

High severity, with a CVSS score of 8.1, published 25 October 2026.

How is CVE-2026-116204 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116204?

Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116204: YesWiki cross-site request forgery in despam action

CVE-2026-116204 · Severity: high · CVSS 8.1 · Published 2026-10-25

YesWiki is a wiki platform that allows collaborative content creation. An unauthenticated attacker can trick an administrator into visiting a malicious wiki page, which silently triggers page deletions or content overwrites on the administrator's behalf. This could destroy critical pages like the site front page or configuration pages, rendering the wiki unusable until restored from backups.

Technologies: YesWiki. Vendors: YesWiki.

Quick answers

Is CVE-2026-116204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116204 being exploited in the wild.
How severe is CVE-2026-116204?: High severity, with a CVSS score of 8.1, published 25 October 2026.
Which products and versions are affected?: YesWiki before 4.7.0.
Is there a fix for CVE-2026-116204?: Yes: fixed in 4.7.0. Until then: Restrict default_write_acl to authenticated users, disable allow_raw_html, or implement a restrictive Content-Security-Policy (form-action directive) in wakka.config.php to prevent same-site form submissions to the despam action. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116204 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116204?: Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.7.0

Restrict default_write_acl to authenticated users, disable allow_raw_html, or implement a restrictive Content-Security-Policy (form-action directive) in wakka.config.php to prevent same-site form submissions to the despam action.

Technical details

The despam action (tools/security/actions/despam.php) validates the user is an administrator via session cookie but implements no CSRF token, Origin/Referer verification, or per-request confirmation. An attacker exploits YesWiki's default configurations—which allow any visitor to create pages with raw HTML—by planting an auto-submitting form that, when viewed by a logged-in admin, sends same-site POST requests with destructive parameters (clean, suppr[], rev[]) that unconditionally delete pages across six database tables or restore arbitrary historical revisions.

Affected products

YesWiki YesWiki before 4.7.0

Timeline

2026-10-09: disclosed
2026-10-25: advisory
2026-10-25: patched: version 4.7.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.