Authentication Bypass in YesWiki via AJAX Mail Handler

Executive Summary

CVE-2026-104446 is an authentication bypass in YesWiki versions before 4.6.7. It allows unauthenticated attackers to send emails through the wiki's SMTP server by exploiting a flaw in the contact mail AJAX handler. The vulnerability occurs because the system incorrectly initializes an access check variable to true, enabling attackers to bypass authentication by omitting certain parameters and supplying crafted input. This lets them control recipient, sender, subject, and body fields, turning the wiki into an open mail relay for spam or phishing.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual outbound SMTP traffic from your YesWiki server. Check for POST requests to /<AnyPage>/mail endpoints without proper authentication. Inspect logs for emails sent from the wiki's SMTP server with spoofed sender addresses or unexpected recipients.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to send spam or phishing emails using your wiki's SMTP server. This can lead to your domain being blacklisted by email providers, reputational damage, and potential legal or compliance issues. Your server's resources may also be consumed by processing unauthorized email traffic.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR if personal data is exposed through unauthorized email transmission. For HIPAA, it may risk unauthorized disclosure of protected health information if emails contain such data. Organizations could face fines or penalties for failing to protect sensitive data due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later. If upgrading is not possible, disable the contact mail AJAX handler by removing or restricting access to the mail.php file. Configure the wiki's contact_from setting to enforce sender validation.

Useful 0 Not Useful 0