YesWiki EUVD-2026-91458

Exploitation requires that a user with administrator privileges be actively logged into the target YesWiki instance (<4.6.7) and be lured into visiting an attacker-controlled link that triggers the autoupdate UpdateAction with action=delete and a package parameter; the vulnerable endpoint accepts state-changing deletions via unprotected GET requests with no anti-CSRF token. Limiting factors: success depends on administrator user interaction (clicking/loading the crafted link), a valid authenticated admin session being present in the victim's browser, and the attacker knowing or guessing the package name to delete - there is no direct, interaction-free path for an unauthenticated attacker.

This is a moderate-priority, context-dependent issue rather than a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable flaw requiring no attacker privileges but passive user interaction (UI:P) - classic CSRF, consistent with CWE-352. The attacker is unauthenticated, but exploitation hinges entirely on tricking an already-authenticated administrator into visiting a crafted link, which meaningfully lowers real-world likelihood versus a direct unauthenticated RCE. Impact is skewed toward availability (VA:H - deleting extensions like bazar breaks core site functionality) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N); there is no data theft or code execution. EPSS is not provided, so exploitation probability cannot be quantified. KEV status is not listed (no confirmed active exploitation) and no POC is referenced, so this rests on vendor/VulnCheck analysis rather than observed attacks. Net: a legitimate availability/integrity bug worth patching, but not a drop-everything emergency - the UI:P requirement and lack of exploitation evidence put it below genuinely wormable network flaws.

An attacker crafts a malicious web page or email link pointing at the victim YesWiki instance's autoupdate UpdateAction with action=delete and a package parameter (e.g. bazar). When a logged-in administrator is lured into visiting it, their authenticated session silently issues the unprotected GET request, deleting the extension and breaking site functionality. No public exploit identified at time of analysis, and the network attack vector with low complexity makes the forged request trivial to construct once a target admin is socially engineered.