CVE-2026-104439 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to a user enumeration vulnerability located within the LostPasswordAction.php module, which serves as the entry point for password reset functionality. This flaw stems from an implementation deficiency where the application fails to provide consistent feedback when processing requests for lost passwords associated with non-existent or invalid email addresses. Instead of returning a uniform response indicating that no account was found regardless of whether the input is valid or not, the system exhibits distinguishable behavioral differences based on the existence of the user in its database. This inconsistency allows unauthenticated external actors to probe the application by submitting various email addresses and analyzing the server's reaction to determine if a specific address corresponds to an active registered user.
The technical nature of this vulnerability aligns with CWE-204, which classifies observable response discrepancy as a type of information exposure flaw. By leveraging these differing responses, attackers can effectively map out valid usernames or email addresses within the system without requiring any form of authentication. The absence of rate limiting mechanisms on the MotDePassePerdu recovery page exacerbates this risk by allowing adversaries to automate large-scale queries against the endpoint. This lack of throttling enables rapid enumeration attempts that would otherwise be detected and blocked by standard security controls, thereby facilitating efficient reconnaissance activities aimed at identifying high-value targets within the organization's user base.
From an operational perspective, the primary impact of this vulnerability is the facilitation of subsequent malicious campaigns such as targeted phishing attacks or password-spraying assaults. Once valid email addresses are confirmed through enumeration, attackers can craft highly convincing spear-phishing messages tailored to specific individuals, significantly increasing the likelihood of credential compromise. Alternatively, these verified accounts serve as a curated list for automated password-spraying tools that attempt common passwords across multiple accounts simultaneously. This capability lowers the barrier for entry for threat actors and increases the overall attack surface by turning a simple administrative feature into a powerful reconnaissance tool.
To mitigate this vulnerability, it is imperative to implement consistent response behaviors regardless of whether an email address exists in the database. The application should always return a generic success message indicating that if the provided email corresponds to a registered account, a password reset link will be sent, thereby preventing attackers from inferring user existence based on error messages or timing differences. Additionally, implementing strict rate limiting and CAPTCHA challenges on the password recovery endpoint is essential to prevent automated enumeration scripts from efficiently probing large volumes of addresses. These measures should align with industry standards such as OWASP Authentication Cheat Sheet guidelines for secure implementation of forgotten password features and MITRE ATT&CK techniques related to Credential Access via Phishing or Brute Force, ensuring that reconnaissance efforts are effectively hindered before they can lead to account compromise.