YesWiki CVE-2026-116828

Requires an authenticated YesWiki administrator - despam.php is gated on UserIsAdmin() at line 23, so this cannot be reached by anonymous or low-privileged users. The attacker must reach the {{despam}} action (an admin can create the page per YesWiki's own anti-spam documentation) and submit its form (second gate is the form's own submit button, $_POST['2']). Creating the action page is subject to the hashcash antispam (use_hashcash defaults to true in tools/security/config.yaml), which the published PoC solves programmatically rather than being a true barrier. No other non-default configuration is required: all YesWiki versions before 4.7.0 are affected in default installs. The exploit as run is read-only (blind reads via the SELECT that lists candidate pages); the dominant limiting factor is the administrator-privilege requirement, not configuration.

This is a genuine but gated confidentiality issue rather than a drop-everything emergency, and the signals are internally consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H) scores 6.9 (medium): network-reachable over HTTP with low complexity, but PR:H means it is exploitable only by an authenticated administrator, and impact is confidentiality-only (blind database reads). EPSS is low at 0.25% (16th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. Offsetting that, a full, self-verifying PoC is published in the vendor GHSA advisory and confirmed working against development HEAD, which removes any research barrier for an attacker who already holds admin access. The vuln.today decision label is 'this_month', which aligns with the combined picture: credible and weaponized in PoC form, but bounded by the administrator-privilege precondition and low observed exploitation. The practical escalation concern is that the blind read targets yeswiki_users.password hashes, so one compromised or malicious admin can harvest other users' (including other admins') credentials - the same escalation path noted for CVE-2026-46670. No signals conflict here; the main caveat is that risk is almost entirely a function of how exposed and trusted YesWiki admin accounts are in a given deployment.

An authenticated administrator (or an attacker who has phished or reused credentials for an admin account) creates a page containing the {{despam}} action and submits its form with a crafted 'from' POST parameter. Because the value is escaped but placed in an unquoted INTERVAL operand, the attacker breaks out with parentheses and comment markers to append boolean/time-based conditions, using the rendered result-row count as an oracle to blind-read arbitrary data including yeswiki_users.password. A full self-verifying PoC exists and is confirmed working; attack complexity is low once admin access is held.