YesWiki CVE-2026-104449

Requires a YesWiki instance older than 4.6.7 with the Bazar entry-creation flow reachable by unauthenticated users and at least one existing wiki page to target. The attacker supplies an attacker-controlled id_fiche matching an existing page; the flaw is that the write ACL on that page is not enforced during Bazar entry creation (CWE-639, authorization bypass through user-controlled key). Limiting factors: exploitation depends on the Bazar feature being enabled/exposed and on knowing or guessing valid existing page identifiers (reflected in the vector's AT:P attack requirement); impact is bounded to integrity/availability of page content (defacement, destruction) with no confidentiality exposure.

This is a genuine, actionable priority rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which strongly favors exploitation. The scored impact is correctly weighted to integrity (VI:H) with limited availability impact (VA:L) and no confidentiality impact (VC:N), consistent with a page-overwrite/defacement primitive rather than data theft or RCE. One nuance: the vector sets AT:P (attack requirement present), meaning successful exploitation is not fully unconditional - the attacker needs a reachable Bazar entry-creation flow and existing target pages, which tempers the otherwise maximal exploitability metrics. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation; exploitation likelihood is therefore inferred from the vector and the conceptual simplicity of the id_fiche parameter abuse rather than measured. Net: high-value integrity/defacement risk on affected YesWiki instances, patch available, but real-world urgency is moderated by the product's limited deployment footprint and the absence of exploitation telemetry.

An unauthenticated attacker locates an internet-facing YesWiki instance (before 4.6.7) that exposes the Bazar entry-creation flow and submits a crafted entry whose attacker-controlled id_fiche matches an existing page. The server honors the supplied identifier without enforcing the target page's write ACL, overwriting the page body and enabling mass defacement or content destruction. No public exploit code is identified at time of analysis, but the attack requires only a single crafted HTTP request and no authentication.