Security readout for executives and security teams
Plain-English summary
YesWiki versions before 4.6.6 can allow an unauthenticated visitor to delete arbitrary wiki pages when public page writing is enabled, as it is by default on fresh installations. Important content—including front, administration, and other users’ pages—could be permanently removed. The issue affects integrity and availability, not confidentiality.
Executive priority
Treat exposed, vulnerable YesWiki installations as an immediate remediation priority because an unauthenticated attacker may destroy business content without user interaction. Upgrade promptly and confirm backups. Privately restricted instances remain important but can follow exposed systems in the remediation queue after their access controls are verified.
Technical view
The `erasespamedcomments` action accepts page identifiers through a POST array and passes them into the deletion path without an authorization check. YesWiki’s allow-by-default action ACL and default public write ACL can make the flaw remotely exploitable without authentication. CVSS 3.1 rates it 9.1: network-accessible, low complexity, no privileges or interaction, with high integrity and availability impact.
Likely exposure
Highest exposure exists on internet-accessible YesWiki installations earlier than 4.6.6 that permit untrusted users to write pages, including fresh installations retaining `default_write_acl='*'`. Restricting write access may reduce practical exposure, but the supplied sources do not establish that configuration controls fully remediate the vulnerable deletion path.
Exploitation context
The flaw requires no authentication or user interaction under the documented default configuration and can cause broad content destruction. The supplied bundle marks it absent from KEV and provides no evidence of active exploitation. Public disclosure includes the advisory and correcting commit, which may increase attacker awareness.
Researcher notes
The reported weaknesses are CWE-276 and CWE-862. The impact is arbitrary page deletion through a missing authorization check, with no reported confidentiality loss. Assessment should focus on installed version, reachability, write ACLs, and integrity evidence. The supplied material identifies 4.6.6 and commit `ed5b548a705c8091ba0282aaaba73ddda976abef` as the correction.
Mitigation direction
- Upgrade YesWiki to version 4.6.6 or later.
- Restrict page write access to trusted users until upgrading.
- Limit external access to affected YesWiki instances where operationally feasible.
- Verify recoverable backups exist for important wiki content.
Validation and detection
- Inventory YesWiki instances and identify versions earlier than 4.6.6.
- Check whether untrusted or unauthenticated users have page write access.
- Confirm production instances run version 4.6.6 or later.
- Review page history and backups for unexpected deletions after disclosure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-52766 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8xCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abefCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.