CVE-2026-104444: YesWiki Authorization Bypass Vulnerability

CVE-2026-104444 Overview

CVE-2026-104444 is an authorization bypass vulnerability in YesWiki versions prior to 4.6.7. The flaw resides in the editComment route of the comments API. Authenticated low-privilege users can overwrite arbitrary pages or comments by supplying a victim page as the pagetag field in a POST request to the api/comments endpoint. The server fails to enforce per-page write Access Control Lists (ACLs) before applying the edit, enabling content tampering and reparenting of existing pages or comments. The weakness is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated YesWiki user can overwrite protected pages or comments, bypassing per-page write ACLs and compromising wiki content integrity.

Affected Products

• YesWiki versions before 4.6.7
• YesWiki comments API (api/comments endpoint)
• Installations exposing authenticated low-privilege user registration

Discovery Timeline

• 2026-10-02 - CVE-2026-104444 published to NVD
• 2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104444

Vulnerability Analysis

The vulnerability affects the editComment route exposed by the YesWiki comments API. The route accepts a pagetag field from the request body and uses it as the identifier of the resource to update. The route trusts this client-supplied value without validating whether the authenticated caller holds write permissions on the referenced resource. As a result, an attacker can target any page or comment tag in the wiki.

The underlying weakness is an insecure direct object reference governed by a user-controlled key. The server performs an authentication check but not a resource-level authorization check. The comments subsystem assumes the caller owns the comment being edited; the attacker breaks that assumption by naming an unrelated victim tag.

Successful exploitation lets an attacker rewrite restricted wiki pages, overwrite other users' comments, and reparent content under attacker-controlled nodes. This directly undermines integrity controls that YesWiki administrators configure through per-page ACLs.

Root Cause

The editComment handler enforces authentication but omits a per-page write ACL check against the resource identified by pagetag. The access decision is made against the caller's session rather than against the target object.

Attack Vector

An attacker registers or authenticates as a low-privilege user on the target YesWiki instance. The attacker then issues a POST request to api/comments invoking the editComment action with the pagetag field set to a victim page or comment identifier and attacker-controlled content. The server applies the write to the targeted resource. Refer to the GitHub Security Advisory GHSA-894w-63wr-8x5r and the VulnCheck Advisory on YesWiki for additional technical context.

Detection Methods for CVE-2026-104444

Indicators of Compromise

• POST requests to api/comments from low-privilege accounts where the pagetag value does not match a tag the user previously created.
• Wiki page revisions attributed to accounts that lack write ACLs on the modified page.
• Comments whose parent pagetag suddenly changes to an unrelated page or user namespace.

Detection Strategies

• Enable YesWiki revision auditing and compare edit authorship against the ACL assigned to each modified page.
• Review web server access logs for POST requests to /api/comments paired with HTTP 200 responses from non-administrative sessions.
• Correlate authentication events with content modifications to identify accounts editing resources outside their normal scope.

Monitoring Recommendations

• Alert on bursts of api/comments POST requests from a single authenticated session.
• Monitor for new or recently registered accounts that immediately interact with the comments API.
• Track revisions on sensitive pages such as homepages, ACL configuration pages, and administrative documentation.

How to Mitigate CVE-2026-104444

Immediate Actions Required

• Upgrade YesWiki to version 4.6.7 or later.
• Audit recent revisions on sensitive pages and restore any content modified by unauthorized accounts.
• Review and revoke suspicious low-privilege accounts created before the patch was applied.
• Disable open user self-registration until the upgrade is complete if the instance is internet-facing.

Patch Information

YesWiki addressed CVE-2026-104444 in version 4.6.7. The fix enforces a write ACL check against the resource identified by the pagetag field before processing editComment requests. See the GitHub Security Advisory GHSA-894w-63wr-8x5r for the official patch references.

Workarounds

• Restrict access to the api/comments endpoint at the web server or reverse proxy level until the upgrade is deployed.
• Temporarily disable comments functionality in YesWiki configuration if business workflows allow.
• Require administrative review of all new account registrations to limit the pool of users who can reach the vulnerable route.

# Example nginx restriction limiting the comments API to internal networks
location /api/comments {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://yeswiki_backend;
}