Is CVE-2026-116820 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116820 being exploited in the wild.

How severe is CVE-2026-116820?

Medium severity, with a CVSS score of 5.3, published 27 October 2026.

How is CVE-2026-116820 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116820?

Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116820: YesWiki Bazar information disclosure via showreq parameter

CVE-2026-116820 · Severity: medium · CVSS 5.3 · Published 2026-10-27

YesWiki is a wiki platform used for collaborative content management. Versions 4.6.0 through 4.6.x contain a debugging feature that allows unauthenticated users to view the complete SQL queries the server executes when searching the Bazar (data catalog) module by simply adding a showreq parameter to any public search request. An attacker can exploit this to discover database table names, access control rules, and internal schema details, then use that information to craft more targeted SQL injection attacks.

Technologies: YesWiki. Vendors: YesWiki.

Quick answers

Is CVE-2026-116820 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116820 being exploited in the wild.
How severe is CVE-2026-116820?: Medium severity, with a CVSS score of 5.3, published 27 October 2026.
Which products and versions are affected?: YesWiki 4.6.0 before 4.7.0.
Is there a fix for CVE-2026-116820?: Yes: fixed in 4.7.0. Until then: Remove or disable the showreq debug parameter handler in SearchManager::prepareSearchRequest() (tools/bazar/services/SearchManager.php, lines 1016–1017), or gate the debug branch with a configuration flag and authentication check before deploying to production. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116820 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116820?: Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.7.0

Remove or disable the showreq debug parameter handler in SearchManager::prepareSearchRequest() (tools/bazar/services/SearchManager.php, lines 1016–1017), or gate the debug branch with a configuration flag and authentication check before deploying to production.

Technical details

The vulnerability is a debug code path in SearchManager::prepareSearchRequest() that echoes the fully assembled SQL query whenever the request includes a showreq query parameter, with no authentication, administrator role, or debug-mode gating. The Bazar listing API routes are declared public and unauthenticated, so any attacker can trigger the vulnerable branch by appending showreq=1 to a listing request; the output is injected into the JSON response as a rawOutput field. The disclosed SQL reveals prefixed table names, JSON extraction paths for data storage, ACL filter logic, and database collation—reconnaissance that reduces the attack surface for SQL injection.

Affected products

YesWiki YesWiki 4.6.0 before 4.7.0

Timeline

2026-10-12: disclosed
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.