CVE-2026-104448
Deferred Deferred - Pending Action

Cross-Site Request Forgery in YesWiki Leading to Arbitrary Page Deletion

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104448
EUVD
EUVD-2026-91459

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.7 has a cross-site request forgery (CSRF) vulnerability in the ajaxdeletepage handler. This flaw allows attackers to delete any page via a GET request with a jsonp_callback parameter, without requiring a CSRF token. The vulnerability bypasses page ownership checks, enabling attackers to permanently remove pages along with associated data like ACLs, links, comments, and referrers.

Detection Guidance

To detect this vulnerability, check YesWiki installations for versions before 4.6.7. Look for GET requests to the ajaxdeletepage handler with a jsonp_callback parameter. Monitor logs for unauthorized page deletions or missing CSRF tokens.

Impact Analysis

If you use YesWiki before 4.6.7, an attacker could trick you or an administrator into clicking a malicious link. This would delete important pages and their related data, disrupting your wiki's functionality and potentially causing data loss. The attack requires no special privileges beyond being logged in.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized deletion of sensitive data. GDPR requires data integrity and availability, while HIPAA mandates protection of health information. Unauthorized deletions may violate these requirements, potentially leading to legal or regulatory penalties.

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later. Disable GET requests for the ajaxdeletepage handler if possible. Implement CSRF tokens for all state-changing requests. Review logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104448. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart