# CVE-2026-116820: YesWiki Bazar information disclosure via showreq parameter

Source: https://junglewise.ai/threats/cve-2026-116820-yeswiki-from-4-6-0-before-4-7-0-contains-an-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116820 · Severity: medium · CVSS 5.3 · Published 2026-10-27

YesWiki is a wiki platform used for collaborative content management. Versions 4.6.0 through 4.6.x contain a debugging feature that allows unauthenticated users to view the complete SQL queries the server executes when searching the Bazar (data catalog) module by simply adding a showreq parameter to any public search request. An attacker can exploit this to discover database table names, access control rules, and internal schema details, then use that information to craft more targeted SQL injection attacks.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-116820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116820 being exploited in the wild.

**How severe is CVE-2026-116820?** Medium severity, with a CVSS score of 5.3, published 27 October 2026.

**Which products and versions are affected?** YesWiki 4.6.0 before 4.7.0.

**Is there a fix for CVE-2026-116820?** Yes: fixed in 4.7.0. Until then: Remove or disable the showreq debug parameter handler in SearchManager::prepareSearchRequest() (tools/bazar/services/SearchManager.php, lines 1016–1017), or gate the debug branch with a configuration flag and authentication check before deploying to production. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116820 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116820?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.7.0

Remove or disable the showreq debug parameter handler in SearchManager::prepareSearchRequest() (tools/bazar/services/SearchManager.php, lines 1016–1017), or gate the debug branch with a configuration flag and authentication check before deploying to production.

## Technical details

The vulnerability is a debug code path in SearchManager::prepareSearchRequest() that echoes the fully assembled SQL query whenever the request includes a showreq query parameter, with no authentication, administrator role, or debug-mode gating. The Bazar listing API routes are declared public and unauthenticated, so any attacker can trigger the vulnerable branch by appending showreq=1 to a listing request; the output is injected into the JSON response as a rawOutput field. The disclosed SQL reveals prefixed table names, JSON extraction paths for data storage, ACL filter logic, and database collation—reconnaissance that reduces the attack surface for SQL injection.

## Affected products

- YesWiki YesWiki 4.6.0 before 4.7.0

## Timeline

- 2026-10-12: disclosed
- 2026-10-27: advisory

## References

- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm)
- [https://www.vulncheck.com/advisories/yeswiki-from-4.6.0-before-4.7.0-sql-query-disclosure-via-showreq-parameter](https://www.vulncheck.com/advisories/yeswiki-from-4.6.0-before-4.7.0-sql-query-disclosure-via-showreq-parameter)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki server-side request forgery in DuplicationManager](https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)