YesWiki CVE-2026-104451

Exploitation requires a victim who is an authenticated, write-capable YesWiki user (editors/contributors with page-edit rights) and who performs a top-level navigation action to an attacker-supplied request targeting RevisionsHandler with the restoreRevisionId parameter; the vulnerable path is the revision-restore handler accepting state-changing GET requests without CSRF token validation. Limiting factors: the attack needs user interaction (UI:P) - the privileged user must be induced to trigger the request - and only affects integrity of page content (reverting to an older/vandalized revision), with no confidentiality or availability impact and no ability to escalate privileges. Instances where no users hold write permissions, or where the victim is not currently authenticated, are not exploitable.

This is a medium-severity (CVSS 5.3, CVSS:4.0) cross-site request forgery flaw whose real-world risk is modest and bounded. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity attack requiring passive user interaction, with impact confined to low integrity (VI:L) and no confidentiality or availability loss (VC:N/VA:N) and no scope change (SC:N/SI:N/SA:N) - consistent with a CSRF that can only revert/overwrite page content, not achieve code execution or data theft. Although PR:N marks the attacker as unprivileged (correct for CSRF, which rides the victim's session), successful exploitation is gated on luring an already-authenticated, write-capable YesWiki user, which materially narrows the viable target population. No EPSS score was supplied, the CVE is not on CISA KEV, and no public proof-of-concept is indicated, so exploitation signals are absent rather than elevated. Net: this is a legitimate but low-priority integrity/defacement issue, not an urgent emergency; the headline CVSS is driven by network vector and low attack complexity rather than by severe impact. Note the input provides only a CVSS 4.0 vector - no CVSS 3.1 vector and no EPSS/POC data were given, so exploitation-likelihood cannot be quantified from the inputs.

An attacker crafts a malicious link or embeds an auto-loading element pointing at the victim YesWiki instance's RevisionsHandler with a chosen restoreRevisionId, then lures a logged-in, write-capable user into a top-level navigation action. Because the restore is performed via a GET request with no CSRF token validation, the victim's browser silently issues the request and the current page is overwritten with a stale or previously vandalized revision. No public exploit code is identified at time of analysis; the low attack complexity (AC:L) but required user interaction (UI:P) means the attacker depends on social engineering of a privileged user.