YesWiki EUVD-2026-91466

Exploitation requires that the target YesWiki instance (version before 4.6.7) actually hosts a page containing the recentchangesrssplus RSS action; the attacker then requests that page's xml method. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and default remote network access suffices once such an action page exists. The primary limiting factor is deployment-specific: sites that do not use the recentchangesrssplus action, or that have already upgraded to 4.6.7+, are not exposed. Impact is further limited to disclosure of 500-character excerpts rather than full restricted content.

This is a moderate-severity information disclosure flaw (CWE-200) with real but bounded impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms it is remotely exploitable by unauthenticated attackers with low complexity and no user interaction, which raises the practical attack surface. However, impact is limited to confidentiality only (VC:L, with VI:N/VA:N), and the leak is partial - 500-character body excerpts rather than full page contents - so the 6.9 score reflects easy exploitation of a limited-disclosure bug rather than a system-compromising issue. No EPSS score, SSVC decision, or POC indicator was provided in the input, and KEV status is not present, so there is no evidence of active exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The vulnerability was reported by VulnCheck and a vendor advisory (GHSA) plus a patch exist, which lends high confidence to the technical details. Net: a legitimate patch-worthy issue for YesWiki operators who host restricted/draft content, but not a widespread emergency given the niche product footprint and confidentiality-only impact. EPSS is absent, so probabilistic exploitation likelihood cannot be stated.

An unauthenticated attacker identifies a YesWiki instance (before 4.6.7) that hosts the recentchangesrssplus RSS action and requests the xml method of that page. The response returns 500-character body excerpts of the latest pages, including read-restricted drafts and notes, leaking content the attacker should not be able to see. No public exploit code was identified in the provided data, but the request requires only a crafted HTTP GET with no authentication.