Cross-Site Request Forgery in YesWiki Leading to Tag Deletion

Executive Summary

CVE-2026-104453 is a Cross-Site Request Forgery (CSRF) vulnerability in YesWiki versions before 4.6.7. It exists in the admintag action, allowing attackers to delete tag associations by tricking administrators into clicking malicious GET links. The vulnerability stems from missing CSRF protection in admintag.php, which only checks admin privileges but not tokens. Since admin cookies use SameSite=Lax, external GET requests still include the cookie, enabling unauthorized deletions.

Useful 0 Not Useful 0

Detection Guidance

Check YesWiki version with: grep -r 'YesWiki' /path/to/yeswiki/version.php. If version is 4.6.6 or earlier, the system is vulnerable. Look for unusual tag deletions in logs or database queries involving the admintag action.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete tag associations in bulk, disrupting navigation and tagging functionality on the YesWiki site. While the site remains operational, loss of tag metadata may affect organization and accessibility of content. Administrators may need to restore deleted tags manually.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized modifications to tag associations, which may affect data integrity and access controls. Unauthorized deletions of tag metadata could compromise how data is organized, tracked, or secured, depending on how tags are used in the system. However, the vulnerability does not directly expose sensitive data but may disrupt organizational workflows that rely on proper tagging for compliance documentation.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade YesWiki to version 4.6.7 or later immediately. Ensure POST requests are enforced for admintag actions and CSRF tokens are validated before deletions. Review and restore any deleted tag associations from backups.

Useful 0 Not Useful 0