YesWiki (< 4.6.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/yeswiki--4.6.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 02 Oct 2026 12:24:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgYesWiki Triples Delete API Authentication Bypasshttps://feed.craftedsignal.io/briefs/2026-10-yeswiki-auth-bypass/Fri, 02 Oct 2026 12:24:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-yeswiki-auth-bypass/An authentication bypass vulnerability in the YesWiki triples delete API allows authenticated users to delete arbitrary semantic triples, potentially resulting in site-wide denial of service.YesWiki versions prior to 4.6.7 are susceptible to an authentication bypass vulnerability residing in the triples delete API. The vulnerability stems from an empty-filter scope bypass, which allows any authenticated user to manipulate or delete semantic triples regardless of defined ownership or permissions. By supplying an empty filter to the triples delete endpoint, an attacker can target critical configuration triples, such as the membership data for the administrative group. Deleting these membership records effectively empties the administrator group, leading to a site-wide administrative lockout. This vulnerability primarily impacts the integrity and availability of YesWiki instances, as unauthorized users can escalate their impact to include a denial of service against the platform administrators.

Impact

Successful exploitation results in unauthorized modification or deletion of semantic data within the YesWiki application. The most severe consequence is the potential for site-wide administrative lockout, rendering the application unmanageable for legitimate administrators until manual remediation of the affected triples is performed.

Recommendation

  1. Upgrade all YesWiki instances to version 4.6.7 or later to remediate CVE-2026-104443.
  2. Audit application logs for anomalous requests to the triples delete API endpoint.
  3. Restrict authentication to the YesWiki management interface to trusted users only to reduce the attack surface.
]]>highadvisoryweb-application-securityauthorization-bypasscve-2026-104444web-vulnerabilitycsrfyeswikisql-injectionvulnerabilitywebserverweb-applicationcvessrffile-uploadremote-code-executionexfiltration