CVE-2026-104455

5.3 MEDIUMpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89vc-h4r4-h25q
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89vc-h4r4-h25q

All references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89vc-h4r4-h25q
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-read-acl-bypass-via-recentchangesrssplus-rss-action
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89vc-h4r4-h25q

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100149PoC
HIGHCVE-2026-100241
HIGHCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
UNSCOREDCVE-2026-100406PoC
MEDIUMCVE-2026-100418PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.