Vulnerability Description
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89vc-h4r4-h25q
- https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-read-acl-bypass-via-re
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89vc-h4r4-h25q
FAQ
What is CVE-2026-104455?
CVE-2026-104455 is a vulnerability with a CVSS score of 5.3 (MEDIUM). YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can reques...
How severe is CVE-2026-104455?
CVE-2026-104455 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-104455?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.