CVE-2026-104459 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The identified security flaw resides within YesWiki versions prior to 4.6.7, specifically affecting the WebfingerService component which is responsible for handling protocol requests related to decentralized identity and social networking protocols. This vulnerability manifests as a Server-Side Request Forgery, commonly abbreviated as SSRF, which represents a critical class of web application security risks where an attacker can induce the server to make HTTP or HTTPS requests to arbitrary destinations under its control. In this specific instance, the flaw allows unauthenticated actors to manipulate the actor_handle parameter within POST requests directed at the abonnements view endpoint. By crafting a payload that specifies numeric host addresses and port numbers rather than standard domain names, attackers bypass typical validation mechanisms that might otherwise restrict access to external or public resources.
The operational impact of this vulnerability is significant because it enables network reconnaissance against internal infrastructure services that are not directly exposed to the internet. Since YesWiki applications often run within corporate networks or behind firewalls, an attacker can leverage this SSRF vector to probe internal HTTPS services and open ports on localhost or other private IP addresses. This capability allows adversaries to map out the internal network topology, identify running services such as databases, administrative panels, or legacy systems, and potentially exploit subsequent vulnerabilities in those discovered services. The ability to trigger requests without authentication lowers the barrier for entry, making this vulnerability particularly dangerous in environments where web applications are deployed with minimal access controls on specific endpoints.
From a classification perspective, this issue aligns directly with CWE-918, which defines Server-Side Request Forgery as a weakness enabling an attacker to cause the server-side application to make requests to unintended destinations. Furthermore, within the MITRE ATT&CK framework, this behavior corresponds to T1571, specifically the Non-Standard Port subcategory under Active Scanning, and potentially T1098 if used for further exploitation chains involving data exfiltration or lateral movement through internal service interactions. The use of numeric hosts and ports indicates a deliberate attempt to circumvent DNS-based restrictions that might be in place as a partial mitigation strategy against SSRF attacks.
To mitigate this vulnerability, organizations running YesWiki versions earlier than 4.6.7 should immediately upgrade to the latest patched version where these input validation checks have been strengthened. In cases where immediate patching is not feasible, network-level controls such as web application firewalls can be configured to block outbound HTTPS requests from the server that target private IP address ranges or loopback interfaces. Additionally, implementing strict allowlists for any domain names permitted in actor_handle parameters and ensuring that all user-supplied input undergoes rigorous sanitization before being processed by internal services are essential defensive measures. Regular security audits and penetration testing focusing on SSRF vectors should be conducted to ensure no similar weaknesses exist elsewhere in the application architecture.