{"id":"CVE-2026-116821","kind":"vulnerability","aliases":["CVE-2026-116821"],"related":[],"title":"YesWiki: wildcard usernames let self-registered users read restricted pages","description":"YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.","summary":"YesWiki before 4.7.0 builds SQL LIKE patterns from usernames without escaping the _ and % wildcards. A self-registered user can pick a name like ___ or %%% to match access tokens meant for others and read pages and Bazar entries restricted to other users or groups through the public Bazar listing API.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","runtime","self-hosted","yeswiki"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed YesWiki version in the wiki's package or version file; `unknown` if the sources do not give the exact location.\n- Check whether open self-registration is enabled on the wiki.","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, disable open self-registration if it is not needed.","status":"open","published_at":"2026-10-27T00:17:16+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:19+00:00","updated_at":"2026-10-27T00:26:19+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T00:26:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, disable open self-registration if it is not needed.","reach":"internet","title":"YesWiki: wildcard usernames let self-registered users read restricted pages","impact":"medium","summary":"YesWiki before 4.7.0 builds SQL LIKE patterns from usernames without escaping the _ and % wildcards. A self-registered user can pick a name like ___ or %%% to match access tokens meant for others and read pages and Bazar entries restricted to other users or groups through the public Bazar listing API.","category":"runtime","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads pages and Bazar entries restricted to other users.","analyst_note":"Confirm whether self-registration is on by default in YesWiki and whether the fix version is 4.7.0 per the advisory.","how_to_check":"- Check the installed YesWiki version in the wiki's package or version file; `unknown` if the sources do not give the exact location.\n- Check whether open self-registration is enabled on the wiki.","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Wikis that run a YesWiki version before 4.7.0 and allow self-registration are exposed, because an ordinary new account can trigger the over-matching ACL lookup. Wikis that restrict accounts to admins or do not use the Bazar listing API for restricted content are less exposed. Teams running YesWiki 4.7.0 or later can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3363,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116821':14A,17A '-2026':13A,16A '4.7.0':26B,76C 'access':51B 'acl':81C,112C 'aclservic':84C 'api':73B,130C 'attack':101C 'bazar':60B,71B,117C,128C 'build':27B 'bypass':82C 'contain':77C 'cve':12A,15A 'entri':61B,118C 'escap':34B,94C 'group':67B,124C 'host':22B 'interpol':87C 'let':4A 'like':29B,47B,91C 'list':72B,129C 'match':50B,111C 'meant':53B 'name':46B 'other':55B 'over-match':109C 'page':11A,58B,115C 'pattern':30B,92C 'php':18B 'pick':44B 'public':70B,127C 'read':9A,57B,80C,114C 'read-acl':79C 'regist':7A,41B,100C 'restrict':10A,62B,119C 'runtim':19B 'self':6A,21B,40B,99C 'self-host':20B 'self-regist':5A,39B,98C 'sql':28B,90C 'token':52B,113C 'updaterequestwithacl':85C 'use':103C 'user':8A,42B,65B,122C 'usernam':3A,32B,88C,104C 'via':125C 'wildcard':2A,37B,97C 'without':33B,93C 'yeswiki':1A,23B,24B,74C","nicknames":[],"mitigations":[],"who_affected":"Wikis that run a YesWiki version before 4.7.0 and allow self-registration are exposed, because an ordinary new account can trigger the over-matching ACL lookup. Wikis that restrict accounts to admins or do not use the Bazar listing API for restricted content are less exposed. Teams running YesWiki 4.7.0 or later can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116821","severity":null,"published_at":"2026-10-27T00:17:16+00:00","modified_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}