{"id":"CVE-2026-116204","kind":"vulnerability","aliases":["CVE-2026-116204"],"related":[],"title":"YesWiki: forged admin request deletes or restores pages via despam action","description":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.","summary":"YesWiki before 4.7.0 has a cross-site request forgery flaw in its despam action, which accepts state-changing requests without a token check. An attacker can plant an auto-submitting form on a wiki page so that an administrator's browser deletes or overwrites pages.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin footer; versions below `4.7.0` are affected.\n- Confirm whether `tools/security/actions/despam.php` exists and is reachable in the deployment.","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, restrict edits and page-level HTML so visitors cannot place raw HTML forms on wiki pages.","status":"open","published_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:30+00:00","updated_at":"2026-10-25T14:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, restrict edits and page-level HTML so visitors cannot place raw HTML forms on wiki pages.","reach":"internet","title":"YesWiki: forged admin request deletes or restores pages via despam action","impact":"medium","summary":"YesWiki before 4.7.0 has a cross-site request forgery flaw in its despam action, which accepts state-changing requests without a token check. An attacker can plant an auto-submitting form on a wiki page so that an administrator's browser deletes or overwrites pages.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Pages deleted or overwritten through an administrator's session","analyst_note":"Check the NVD entry and the YesWiki 4.7.0 release notes to confirm the fix and whether raw HTML injection is required.","how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin footer; versions below `4.7.0` are affected.\n- Confirm whether `tools/security/actions/despam.php` exists and is reachable in the deployment.","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Any YesWiki installation before 4.7.0 where an administrator is logged in and can view pages that visitors can edit or inject HTML into. Wikis with no raw HTML allowed and no public write access are less exposed. Sites on 4.7.0 or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3367,"output_tokens":586,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116204':14A,17A '-2026':13A,16A '4.7.0':26B,74C 'accept':40B 'action':11A,38B,86C 'admin':3A 'administr':65B,98C,117C 'attack':50B,91C,101C 'auto':55B,106C 'auto-submit':54B,105C 'browser':67B 'chang':43B 'check':48B 'clean':122C 'configur':130C 'contain':75C 'content':135C 'cross':30B,78C 'cross-sit':29B,77C 'current':134C 'cve':12A,15A 'delet':5A,68B,92C,128C 'despam':10A,37B,85C 'flaw':34B 'forg':2A 'forgeri':33B,81C 'form':57B,110C 'host':22B 'html':109C 'let':89C 'overwrit':70B,133C 'packag':18B 'page':8A,61B,71B,95C,114C,131C 'pageprincipal':129C 'paramet':126C 'php':19B 'plant':52B,103C 'post':121C 'raw':108C 'request':4A,32B,44B,80C 'restor':7A,94C 'rev':125C 'self':21B 'self-host':20B 'session':100C 'site':31B,79C 'state':42B 'state-chang':41B 'submit':56B,107C 'suppr':123C 'token':47B 'tools/security/actions/despam.php':87C 'unauthent':90C 'via':9A 'view':119C 'vulner':82C 'wiki':60B,113C 'without':45B 'yeswiki':1A,23B,24B,72C","nicknames":[],"mitigations":[],"who_affected":"Any YesWiki installation before 4.7.0 where an administrator is logged in and can view pages that visitors can edit or inject HTML into. Wikis with no raw HTML allowed and no public write access are less exposed. Sites on 4.7.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116204","severity":null,"published_at":"2026-10-25T14:17:01+00:00","modified_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}