# CVE-2026-116204: YesWiki cross-site request forgery in despam action

Source: https://junglewise.ai/threats/cve-2026-116204-yeswiki-before-4-7-0-contains-a-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116204 · Severity: high · CVSS 8.1 · Published 2026-10-25

YesWiki is a wiki platform that allows collaborative content creation. An unauthenticated attacker can trick an administrator into visiting a malicious wiki page, which silently triggers page deletions or content overwrites on the administrator's behalf. This could destroy critical pages like the site front page or configuration pages, rendering the wiki unusable until restored from backups.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-116204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116204 being exploited in the wild.

**How severe is CVE-2026-116204?** High severity, with a CVSS score of 8.1, published 25 October 2026.

**Which products and versions are affected?** YesWiki before 4.7.0.

**Is there a fix for CVE-2026-116204?** Yes: fixed in 4.7.0. Until then: Restrict default_write_acl to authenticated users, disable allow_raw_html, or implement a restrictive Content-Security-Policy (form-action directive) in wakka.config.php to prevent same-site form submissions to the despam action. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116204 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116204?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.7.0

Restrict default_write_acl to authenticated users, disable allow_raw_html, or implement a restrictive Content-Security-Policy (form-action directive) in wakka.config.php to prevent same-site form submissions to the despam action.

## Technical details

The despam action (tools/security/actions/despam.php) validates the user is an administrator via session cookie but implements no CSRF token, Origin/Referer verification, or per-request confirmation. An attacker exploits YesWiki's default configurations—which allow any visitor to create pages with raw HTML—by planting an auto-submitting form that, when viewed by a logged-in admin, sends same-site POST requests with destructive parameters (clean, suppr[], rev[]) that unconditionally delete pages across six database tables or restore arbitrary historical revisions.

## Affected products

- YesWiki YesWiki before 4.7.0

## Timeline

- 2026-10-09: disclosed
- 2026-10-25: advisory
- 2026-10-25: patched: version 4.7.0 released

## References

- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72)
- [https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-csrf-via-despam-admin-action](https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-csrf-via-despam-admin-action)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki server-side request forgery in DuplicationManager](https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)