{"id":"CVE-2026-116820","kind":"vulnerability","aliases":["CVE-2026-116820"],"related":[],"title":"YesWiki: unauthenticated showreq parameter leaks assembled SQL queries","description":"YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.","summary":"YesWiki from 4.6.0 before 4.7.0 shows assembled SQL queries when an attacker adds the showreq parameter to public Bazar listing API requests. The leaked table names, JSON storage paths, ACL filter logic and collation give an attacker what they need to craft targeted SQL injection.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","runtime","self-hosted","yeswiki"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"- Check the installed YesWiki version in the wiki's package or version file and confirm whether it is `4.6.0` or later but before `4.7.0`\n- Request a public Bazar listing API endpoint with `showreq` appended and see whether SQL query text is returned","fix":"- Upgrade YesWiki to `4.7.0` or later\n- unknown whether a configuration workaround exists","status":"open","published_at":"2026-10-27T00:17:16+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:28+00:00","updated_at":"2026-10-27T00:26:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-27T00:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later\n- unknown whether a configuration workaround exists","reach":"internet","title":"YesWiki: unauthenticated showreq parameter leaks assembled SQL queries","impact":"low","summary":"YesWiki from 4.6.0 before 4.7.0 shows assembled SQL queries when an attacker adds the showreq parameter to public Bazar listing API requests. The leaked table names, JSON storage paths, ACL filter logic and collation give an attacker what they need to craft targeted SQL injection.","category":"runtime","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker learns database schema details to aid SQL injection","analyst_note":"Confirm the fixed version and any workaround from the NVD entry or the YesWiki release notes, and check whether the Bazar API is public by default.","how_to_check":"- Check the installed YesWiki version in the wiki's package or version file and confirm whether it is `4.6.0` or later but before `4.7.0`\n- Request a public Bazar listing API endpoint with `showreq` appended and see whether SQL query text is returned","needs_analyst":true,"not_affected_if":["version-outside-range","auth-required"],"who_is_affected":"Any YesWiki installation from 4.6.0 before 4.7.0 that exposes Bazar listing API endpoints to the public is exposed, because the leak needs no login. Sites where those endpoints are restricted to logged-in users, or that run a version outside this range, are not affected by this description.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":3350,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116820':11A,14A '-2026':10A,13A '4.6.0':23B,68C '4.7.0':25B,70C 'acl':50B,107C 'add':33B,86C 'aid':112C 'allow':77C 'api':41B,98C 'append':92C 'assembl':6A,27B,82C 'attack':32B,57B,79C,90C 'bazar':39B,96C 'collat':54B,111C 'contain':71C 'craft':62B 'cve':9A,12A 'disclosur':74C 'filter':51B,108C 'give':55B 'host':19B 'inform':73C 'inject':65B,115C 'json':47B,104C 'leak':5A,44B 'list':40B,97C 'logic':52B,109C 'name':46B,103C 'need':60B 'obtain':101C 'paramet':4A,36B,89C 'path':49B,106C 'php':15B 'public':38B,95C 'queri':8A,29B,84C 'request':42B,99C 'runtim':16B 'self':18B 'self-host':17B 'show':26B 'showreq':3A,35B,88C,93C 'sql':7A,28B,64B,83C,114C 'storag':48B,105C 'tabl':45B,102C 'target':63B,113C 'unauthent':2A,78C 'view':81C 'vulner':75C 'yeswiki':1A,20B,21B,66C","nicknames":[],"mitigations":[],"who_affected":"Any YesWiki installation from 4.6.0 before 4.7.0 that exposes Bazar listing API endpoints to the public is exposed, because the leak needs no login. Sites where those endpoints are restricted to logged-in users, or that run a version outside this range, are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116820","severity":null,"published_at":"2026-10-27T00:17:16+00:00","modified_at":"2026-10-27T00:17:16+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}