YesWiki CVE-2026-104453

Exploitation requires an authenticated administrator with an active session to be lured into a top-level navigation (e.g., clicking a crafted link) to the vulnerable admintag action - this administrator interaction is the primary limiting factor. The attack depends on the delete_tag parameter being accessible via GET, which allows the SameSite=Lax session cookie to be transmitted during top-level navigation, and on the admintag action lacking CSRF token protection in YesWiki versions before 4.6.7. It does not work against default-safe states where no admin is logged in or where the admin does not interact with the attacker-controlled link; it also cannot be triggered by a cross-site background request (e.g., iframe or XHR) because SameSite=Lax blocks those, which is why top-level navigation is specifically required. Impact is limited to deletion of tag associations (tag triples), not broader data or code compromise.

This is a moderate-to-low real-world priority despite the medium 5.3 CVSS 4.0 score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates a network-reachable, low-complexity attack requiring no attacker privileges but DOES require passive user interaction - specifically a logged-in administrator being lured to a crafted link, which is the defining limiter of this CSRF (CWE-352). Impact is constrained to low integrity and low availability (VI:L/VA:L) with no confidentiality loss (VC:N/SC:N), consistent with the bounded harm of deleting tag associations rather than full compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals reinforces that this is a defense-in-depth hygiene fix rather than an urgent threat. The SameSite=Lax cookie detail is important: because Lax permits top-level GET navigations to carry the session cookie, the GET-based delete_tag action remains exploitable via a simple lured link, which is why the finding is valid despite modern browser defaults. No conflicting signals were observed between the CVSS vector and the description - both agree on a remote, interaction-dependent, limited-impact CSRF.

An attacker crafts a malicious page or email link pointing at the victim YesWiki instance's admintag action with a wide id range in the delete_tag parameter. When a logged-in administrator is lured into following the link via top-level navigation, their SameSite=Lax session cookie is automatically sent, and the server bulk-deletes tag triples without any CSRF token validation. No public exploit code was identified in the provided data, but the attack is trivial to construct given the GET-based design.