CVE-2026-43937: YetAnotherForum.NET authorization bypass and SQL injection in Admin pages

CVE-2026-43937 · Severity: high · CVSS 8.8 · Published 2026-05-12

YetAnotherForum.NET (YAF.NET) is a popular open-source forum software built on ASP.NET. A security flaw allows any registered user, even those with the lowest level of access, to bypass administrative protections and execute arbitrary database commands. This could lead to the theft of sensitive user data, full deletion of the forum database, or unauthorized promotion of a regular user to a site administrator.

Technologies: YAFNET.Core (NuGet), YAF.NET Core, YAFNET YetAnotherForum.NET. Vendors: NuGet, YAF.NET, YAFNET.

Quick answers

Is CVE-2026-43937 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43937 being exploited in the wild.
How severe is CVE-2026-43937?
High severity, with a CVSS score of 8.8, published 12 May 2026.
Which products and versions are affected?
YAFNET.Core (NuGet) <= 4.0.4, ECOSYSTEM:introduced=0,fixed=4.0.5; YAF.NET Core <= 4.0.4; YAFNET YetAnotherForum.NET < 4.0.5.
Is there a fix for CVE-2026-43937?
Yes. YAFNET.Core (NuGet): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43937 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43937?
Check whether you run YAFNET.Core (NuGet), YAF.NET Core or YAFNET YetAnotherForum.NET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • YAFNET.Core (NuGet): upgrade to 4.0.5 or later
    dotnet add package YAFNET.Core --version 4.0.5

Technical details

A logic flaw in the authorization lifecycle of YAF.NET allows low-privileged users to bypass administrative access controls. The application uses PageSecurityCheckAttribute (a ResultFilterAttribute) to enforce admin restrictions; however, because ResultFilters execute after the page handler completes, the handler's side effects (such as database writes) occur before the authorization check redirects the user. An attacker can specifically target the /Admin/RunSql endpoint by sending a POST request to the OnPostRunQuery handler. This handler binds the 'Editor' parameter directly to a SQL execution method without additional permission checks, enabling arbitrary blind SQL injection. This can be used to extract data via time-based oracles, modify identity tables, or achieve OS-level command execution if the database environment is insufficiently hardened. The issue is resolved in version 4.0.5 by migrating authorization checks to IAsyncPageFilter.

Affected products

  • YAFNET YetAnotherForum.NET (YAF.NET) < 4.0.5

Identifiers

  • CVE-2026-43937
  • GHSA-xhw7-j96h-c3g5

Timeline

  • 2026-04-26: advisory: GitHub Security Advisory published
  • 2026-05-12: disclosed: CVE published to NVD
  • 2026-05-12: patched: Fix released in version 4.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.