YesWiki CVE-2026-116820

Exploitation requires that the target run YesWiki 4.6.0 through at least 4.6.7 with the Bazar tool in use and at least one public Bazar entry-listing route reachable (the ApiController routes bazarlist / forms entries json are declared ACL 'public' by default) or a wiki page rendering a {{bazarliste}} action. No authentication, administrator role, debug configuration, or user interaction is needed, and the showreq parameter is satisfied by any value including an empty string, so default configurations are exploitable. Limiting factors: the instance must actually expose a Bazar listing endpoint, and the disclosure is reconnaissance only - it reveals schema/ACL/collation detail but does not directly return user records or credentials in the unauthenticated case. As an interim mitigation the advisory states operators can block or strip the showreq query parameter at a reverse proxy or WAF; the vendor fix is to remove or admin-gate the debug branch.

Signals are internally consistent and point to a genuine but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity access, and the source evidence confirms the Bazar listing API routes are declared ACL 'public' and the only guard is isset($_GET['showreq']), so the triggering conditions are real and trivially met. However, impact is confined to confidentiality of internal structure: VC:L with VI:N/VA:N, consistent with CWE-215 (information disclosure of debug data). EPSS is low at 0.23% (14th percentile) and there is no CISA KEV listing, which aligns with a reconnaissance-only primitive that does not by itself yield records, credentials, code execution, or data modification. The vuln.today decision label is 'this_month' (not act_now/emergency), matching the low EPSS and absence of active-exploitation signals. The main nuance is that this flaw is a force-multiplier: it lowers the cost of follow-on targeted SQL injection and ACL-bypass attacks by exposing prefixed table names, JSON_EXTRACT paths, ACL LIKE logic, and collation. Net: a legitimate patch-this-cycle item for YesWiki operators, not a drop-everything issue, with severity driven by its value as a stepping stone rather than direct impact.

An unauthenticated attacker appends showreq to a public Bazar listing API call (e.g. GET /?api/entries/bazarlist&showreq=1) and reads the fully assembled SQL query returned in the JSON response under a rawOutput key. Because the attack vector is network, complexity is low, and no authentication or user interaction is required, this is reliable against default installations. The advisory documents concrete reproduction steps, so a public PoC reference exists, though the input does not confirm a packaged working exploit; the disclosed schema and ACL logic is then used to craft targeted SQL injection against the same instance.