CVE-2026-104443

8.1 HIGHpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI risk analysis

Summary: YesWiki before 4.6.7 allows any authenticated user to delete or forge arbitrary semantic triples, potentially leading to a site-wide authorization lockout.
Exploitability: Exploitation is relatively straightforward for any authenticated user with access to the triples delete API, requiring only an empty filter payload.
Blast radius: If exploited, this flaw could result in a complete loss of administrative control over the YesWiki instance, impacting all users and functionality.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to YesWiki 4.6.7 or later.

auth-bypasswebapisemantic-triples

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-863

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.