---
id: "CVE-2026-116820"
kind: "vulnerability"
aliases: ["CVE-2026-116820"]
title: "YesWiki: unauthenticated showreq parameter leaks assembled SQL queries"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["php", "runtime", "self-hosted", "yeswiki"]
not_affected_if: ["auth-required", "version-outside-range"]
published_at: "2026-10-27T00:17:16+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116820", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# YesWiki: unauthenticated showreq parameter leaks assembled SQL queries

YesWiki from 4.6.0 before 4.7.0 shows assembled SQL queries when an attacker adds the showreq parameter to public Bazar listing API requests. The leaked table names, JSON storage paths, ACL filter logic and collation give an attacker what they need to craft targeted SQL injection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version in the wiki's package or version file and confirm whether it is `4.6.0` or later but before `4.7.0`
- Request a public Bazar listing API endpoint with `showreq` appended and see whether SQL query text is returned

## Fix

- Upgrade YesWiki to `4.7.0` or later
- unknown whether a configuration workaround exists

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116820

## From the sources

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_