YesWiki CVE-2026-104443

Requires a valid authenticated YesWiki account of any privilege level (CVSS PR:L); the flaw lets that user send an empty filter to the triples delete API so ownership scoping is skipped, enabling deletion or forgery of arbitrary semantic triples. No non-default configuration, platform constraint, or user interaction is needed, and the destructive admin-lockout path specifically targets the admins-group membership triple. The sole meaningful limiting factor is that the instance must allow the attacker to hold (or register) an authenticated account; purely single-admin or registration-closed instances reduce the attacker pool.

This is a genuine integrity/availability risk but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only low privileges - i.e. any authenticated user, with no user interaction. CWE-863 (improper authorization) aligns with the description's 'scope bypass regardless of ownership.' Impact is VI:H/VA:H with VC:N, consistent with a vulnerability that forges/deletes data and can lock out administration but does not expose confidential data. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is driven by low exploitation barrier plus a severe, self-inflicted denial-of-service outcome (admin group emptied → site-wide authorization lockout), tempered by the need for a pre-existing authenticated account and the limited real-world footprint of YesWiki. Net: a real, patch-now issue for operators of multi-user YesWiki instances, but lower urgency than a pre-auth RCE given the PR:L requirement and absence of exploitation signals.

A low-privileged but authenticated YesWiki user (e.g. a self-registered contributor) sends a crafted request with an empty filter to the triples delete API endpoint. Because the empty filter bypasses ownership scoping, the request deletes the triple defining admins-group membership, emptying the admin group and locking all legitimate administrators out of the site. No public POC was provided in the intelligence, though the flaw is low-complexity and trivially reproducible once an account exists.