Quick answers
- Is CVE-2026-116821 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116821 being exploited in the wild.
- How severe is CVE-2026-116821?
- Medium severity, with a CVSS score of 6.5, published 27 October 2026.
- Which products and versions are affected?
- YesWiki before 4.7.0.
- Is there a fix for CVE-2026-116821?
- Yes: fixed in 4.7.0. Until then: Restrict user self-registration by setting noSignupButton to true, or disable public access to Bazar listing API endpoints until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116821 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-116821?
- Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.7.0
Restrict user self-registration by setting noSignupButton to true, or disable public access to Bazar listing API endpoints until upgrading.
Technical details
The vulnerability exists in AclService::updateRequestWithACL(), which constructs SQL LIKE patterns for ACL filtering by interpolating usernames via DbService::escape() (wrapping mysqli_real_escape_string). While this function escapes SQL string delimiters, it does not escape the LIKE metacharacters _ and %, which are accepted by the username validation pattern. An attacker can register with a wildcard-only username like ___ or %%%, causing the ACL predicate to over-match and return entries restricted to other users or groups. The Bazar entry-listing API applies this vulnerable filter when filterOnReadACL=true, exposing restricted content to unauthenticated self-registered attackers.
Affected products
- YesWiki YesWiki before 4.7.0
Timeline
- 2026-10-12: disclosed
- 2026-10-27: patched