CVE-2026-104455 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to an access control bypass vulnerability that stems from improper enforcement of authorization checks within the recentchangesrssplus RSS action module. This flaw allows unauthenticated attackers to retrieve sensitive information by exploiting a logic error in how the application handles requests for restricted content. The core technical issue lies in the fact that while the system correctly identifies pages as read-restricted, it fails to validate whether the requesting user possesses the necessary permissions before generating and serving the RSS feed data. Consequently, any individual with network access can interact with this specific endpoint without needing valid credentials or an active session.
The operational impact of this vulnerability is significant for organizations relying on YesWiki for internal documentation or collaborative projects where confidentiality is paramount. Attackers can exploit the xml method associated with the recentchangesrssplus action to extract up to 500-character body excerpts from every recently modified page in the wiki. This includes drafts, notes, and other content that has been explicitly marked as read-restricted by administrators or users. The ability to scrape these snippets effectively allows an attacker to gather contextual information about ongoing projects, internal communications, or sensitive data entries without triggering standard authentication prompts. This exposure can lead to unauthorized disclosure of proprietary information, intellectual property theft, or the gathering of intelligence that facilitates further attacks against the system and its users.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in authorization logic where access restrictions are not consistently applied across all entry points to protected resources. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1005 Data from Local System Retrieval, as the attacker is extracting data directly from the application's storage mechanisms without proper authentication. The exploitation path involves sending a crafted HTTP request to the RSS action endpoint with the xml parameter set, which bypasses the usual gatekeeping mechanisms designed to protect restricted wiki pages.
To mitigate this risk, administrators must upgrade YesWiki to version 4.6.7 or later, where the access control logic for the recentchangesrssplus module has been corrected to properly enforce permission checks before serving content. Until an update is applied, temporary mitigations include restricting network-level access to the wiki instance if it is exposed to untrusted networks, disabling the RSS action entirely through configuration changes if not required for legitimate operations, or implementing a Web Application Firewall rule that blocks requests targeting this specific endpoint with suspicious parameters. Regular security audits and penetration testing should also be conducted to identify similar logic flaws in other modules where access control might be inconsistently enforced across different request methods or actions.