CVE-2026-52766
Received Received - Intake

Unauthorized Page Deletion in YesWiki

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: GitHub, Inc.

Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-52766

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.6 has a vulnerability in the {{erasespamedcomments}} action. This action allows any user with page write access to delete wiki pages by sending a POST request with a suppr[] array containing page tags. The vulnerability exists because there is no authorization check, and the default write access is set to allow all users (*). This means attackers can permanently delete critical pages like the front page or admin pages.

Detection Guidance

Check if your YesWiki version is below 4.6.6 by running: grep -r 'version' /path/to/yeswiki/config/ or check the footer of your wiki pages. Look for unauthorized page deletions in logs or recent changes.

Impact Analysis

If you use YesWiki before version 4.6.6, any user with write access can delete important wiki pages, including the homepage or admin pages. This could disrupt your wiki's functionality, cause data loss, and require manual restoration of deleted content. The impact is severe as it allows unauthorized users to permanently remove content.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized deletion of wiki pages containing sensitive data. GDPR requires data integrity and availability, while HIPAA mandates protection of health information. Unauthorized deletion violates these requirements by compromising data integrity and availability.

Mitigation Strategies

Upgrade YesWiki to version 4.6.6 or later immediately. If upgrading is not possible, restrict write access by changing default_write_acl from '*' to a specific group in config/config.yaml.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart