CVE-2026-104449: YesWiki Authentication Bypass Vulnerability

CVE-2026-104449 Overview

CVE-2026-104449 is a broken access control vulnerability in YesWiki versions before 4.6.7. The flaw allows unauthenticated attackers to overwrite any existing wiki page by abusing the Bazar entry-creation workflow. Attackers submit a crafted entry containing an attacker-controlled id_fiche value matching an existing page identifier. The application accepts the request and replaces the target page body, bypassing write access control lists (ACLs). The result is mass defacement, content destruction, and loss of page integrity across the wiki. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can overwrite arbitrary wiki pages, including ACL-protected content, enabling site-wide defacement.

Affected Products

YesWiki versions before 4.6.7
YesWiki deployments exposing the Bazar entry-creation endpoint
Public-facing YesWiki instances without upstream access restrictions

Discovery Timeline

2026-10-02 - CVE-2026-104449 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104449

Vulnerability Analysis

The vulnerability resides in the Bazar entry-creation flow of YesWiki. Bazar is the structured-data module used to create and manage form-based entries that correspond to wiki pages. When an entry is submitted, the application accepts an id_fiche value supplied by the client. YesWiki does not validate whether the supplied identifier matches an existing page or whether the requester holds the required write permission. The server proceeds to persist the submitted content under the supplied identifier, overwriting the stored page body.

Because the endpoint does not require authentication, remote attackers can target any known or enumerable page identifier. Pages protected by write ACLs offer no additional defense, since authorization is never consulted during this code path.

Root Cause

The root cause is an authorization bypass through a user-controlled key [CWE-639]. The Bazar handler trusts the id_fiche parameter as the storage key without enforcing ownership checks or evaluating the target page's write ACL. This design confuses entry creation with entry update, collapsing both into a single unauthenticated code path.

Attack Vector

An attacker sends a crafted POST request to the Bazar entry-creation endpoint with id_fiche set to the identifier of a target page and a body containing attacker-chosen content. The server overwrites the existing page without authentication or ACL evaluation. Scripted enumeration of page identifiers enables mass defacement across the entire wiki.

See the GitHub Security Advisory GHSA-4388-phmh-jrw8 and the VulnCheck Advisory for YesWiki for additional technical context.

Detection Methods for CVE-2026-104449

Indicators of Compromise

Unexpected modifications to wiki pages with no corresponding authenticated user in audit logs.
POST requests to Bazar entry-creation endpoints containing id_fiche values that reference pre-existing pages.
Sudden spikes in page revisions originating from a single IP address or user agent.
Page bodies replaced with unrelated content, external links, or defacement markers.

Detection Strategies

Compare current page content hashes against known-good backups to identify unauthorized overwrites.
Alert on unauthenticated HTTP POST traffic to Bazar handlers that includes an id_fiche parameter.
Review YesWiki revision history for anonymous or unattributed edits of ACL-restricted pages.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform for correlation and retention.
Monitor rate and volume of page-edit events to detect automated enumeration of page identifiers.
Track changes to high-value pages such as homepages, policy pages, and navigation templates.

How to Mitigate CVE-2026-104449

Immediate Actions Required

Upgrade YesWiki to version 4.6.7 or later without delay.
Restore any overwritten pages from the most recent clean backup or revision history.
Audit web server logs for prior exploitation attempts targeting the Bazar entry-creation endpoint.
Rotate any credentials or secrets that may have been exposed through modified pages.

Patch Information

YesWiki version 4.6.7 remediates the authorization bypass by validating page ownership and enforcing write ACL checks before persisting Bazar entries. Review the GitHub Security Advisory GHSA-4388-phmh-jrw8 for upstream fix details and upgrade guidance.

Workarounds

Place the YesWiki instance behind an authenticating reverse proxy until the upgrade is applied.
Restrict access to the Bazar entry-creation endpoint via web server access control lists.
Temporarily disable anonymous editing and the Bazar module if operationally feasible.

bash

# Example nginx restriction for the Bazar entry-creation path
location ~ ^/\?.*action=(fiche|bazar) {
    allow 10.0.0.0/8;
    deny all;
}