Live › vulnerability › CVE-2026-116821
Go to dashboardYesWiki before 4.7.0 builds SQL LIKE patterns from usernames without escaping the _ and % wildcards. A self-registered user can pick a name like ___ or %%% to match access tokens meant for others and read pages and Bazar entries restricted to other users or groups through the public Bazar listing API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Wikis that run a YesWiki version before 4.7.0 and allow self-registration are exposed, because an ordinary new account can trigger the over-matching ACL lookup. Wikis that restrict accounts to admins or do not use the Bazar listing API for restricted content are less exposed. Teams running YesWiki 4.7.0 or later can skip this.
No product ranges from the sources yet.
unknown if the sources do not give the exact location.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.
This page as .md · .json · in your agent: get_signal("CVE-2026-116821")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.