CVE-2026-116820 in YesWiki
Summary
by MITRE • 10/27/2026
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The YesWiki content management system version 4.6.0 prior to 4.7.0 contains a critical information disclosure vulnerability that stems from improper handling of debug parameters within its public API endpoints. This flaw allows unauthenticated remote attackers to extract sensitive internal application details by manipulating request parameters, specifically through the use of the showreq parameter. When this parameter is appended to requests targeting the Bazar listing API, which is designed for managing event and task listings, the system inadvertently exposes the underlying SQL queries being executed against the database. This behavior violates fundamental security principles regarding error handling and debug mode exposure in production environments, where such diagnostic information should never be visible to end users or external entities.
From a technical perspective, the vulnerability arises because the application does not adequately sanitize or restrict access to debugging features when processing API calls from unauthenticated sources. By appending showreq to public Bazar listing requests, attackers can trigger the display of assembled SQL statements directly in the response payload. This exposure reveals critical structural information about the database schema, including specific table names and JSON storage paths used by the application for data persistence. Furthermore, it exposes ACL filter logic which dictates access control rules, as well as collation settings that define how string comparisons are performed within the database environment. These details provide a comprehensive map of the backend architecture, significantly lowering the barrier for subsequent exploitation attempts.
The operational impact of this vulnerability is severe due to its role in facilitating more advanced attacks, particularly SQL injection. The disclosed information allows attackers to craft highly targeted and precise malicious payloads that exploit known weaknesses in the database structure or query logic. Knowledge of table names enables direct querying of sensitive data if combined with other vulnerabilities, while understanding ACL filter logic helps attackers bypass intended access controls by crafting requests that evade detection mechanisms. Additionally awareness of collation settings can aid in constructing case-sensitive injection attacks that might otherwise fail due to mismatched character comparisons. This transforms a simple information leak into a potent vector for unauthorized data access and potential system compromise.
This vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information useful for malicious exploitation, as well as CWE-749, relating to exposure of security-relevant configuration details. In terms of offensive tactics, this behavior corresponds to ATT&CK technique T1592.003, specifically Gather Victim Host Information via Querying Local Network Services, where attackers probe services to gather detailed information about the target infrastructure. The ability to view assembled SQL queries also touches upon aspects of reconnaissance that aid in identifying potential injection points within dynamic web applications.
Mitigation strategies must focus on immediate remediation and long-term security hardening. The primary solution is to upgrade YesWiki to version 4.7.0 or later, where this vulnerability has been addressed by restricting the showreq parameter from public API endpoints. For systems that cannot be immediately upgraded, administrators should ensure that debug modes are strictly disabled in production environments and implement web application firewall rules to block requests containing suspicious parameters like showreq when directed at sensitive APIs. Additionally, implementing strict input validation and output encoding practices will help prevent similar information leaks across other parts of the application ecosystem. Regular security audits focusing on API endpoint exposure and error handling mechanisms are recommended to identify and rectify analogous issues before they can be exploited by malicious actors seeking deeper access into the system infrastructure.