YesWiki up to 4.6.5 EraseSpamedCommentsAction.php suppr improper authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in YesWiki up to 4.6.5. This vulnerability affects unknown code of the file actions/EraseSpamedCommentsAction.php. The manipulation of the argument suppr results in improper authorization. This vulnerability is cataloged as CVE-2026-52766. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in YesWiki up to 4.6.5. Affected is an unknown functionality of the file actions/EraseSpamedCommentsAction.php. The manipulation of the argument suppr with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. CVE summarizes:

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-52766 since 06/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

By approaching the search of inurl:actions/EraseSpamedCommentsAction.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.6.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• YesWiki

Version

• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3
• 4.6.4
• 4.6.5

Website

• Product: https://github.com/YesWiki/yeswiki/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion