Executive brief
YesWiki, a collaborative wiki platform, contains a security flaw that allows anyone to permanently delete any page on the site without needing an administrator account. An attacker could use this to remove the home page, administrative settings, or content created by other users, leading to significant data loss and service disruption. This issue is particularly severe on new installations where default settings allow public access to the vulnerable feature.
Technical details
YesWiki contains a missing authorization vulnerability in the `{{erasespamedcomments}}` action (located in `actions/EraseSpamedCommentsAction.php`). The action processes a `suppr[]` array from POST requests and invokes `PageManager::deleteOrphaned()` without verifying if the user has administrative privileges or ownership of the target pages. Furthermore, the default Access Control List (ACL) configuration in YesWiki grants access to this action to all users, including anonymous ones. An attacker can exploit this by creating a page containing the action and then sending a crafted POST request to delete any page in the database, including system-critical pages. The vulnerability is addressed in version 4.6.6.
Affected products
- YesWiki yeswiki/yeswiki < 4.6.6
Timeline
- 2026-06-02: disclosed
- 2026-07-09: advisory
- 2026-07-09: patched: Fixed in version 4.6.6
References
- https://api.github.com/users/CosmicCrusader23
- https://github.com/CosmicCrusader23
- https://api.github.com/users/CosmicCrusader23/gists%7B/gist_id%7D
- https://api.github.com/users/CosmicCrusader23/repos
- https://avatars.githubusercontent.com/u/217740635?v=4
- https://api.github.com/users/CosmicCrusader23/events%7B/privacy%7D