YesWiki EUVD-2026-91475

No special conditions beyond network reachability - remote unauthenticated exploitation against YesWiki instances running a version before 4.6.7 that expose the Bazar abonnements sync action. The concrete prerequisite is that the attacker can reach the sync action endpoint and supply an unvalidated actor URL; exploitation value is highest where the server sits adjacent to internal services or a cloud metadata endpoint (e.g. 169.254.169.254). Limiting factors: the attacker must be able to reach the Bazar subscription/sync feature, the SSRF yields GET requests only, and useful impact depends on the presence of reachable internal or metadata targets from the server's network position.

This is a genuine priority, not merely a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable flaw requiring no authentication, no user interaction, and low complexity, which aligns with the description of an unauthenticated SSRF in the Bazar abonnements sync action. The primary impact is confidentiality (VC:H) because fetched internal/cloud-metadata responses are stored as readable Bazar entries, giving a durable exfiltration primitive rather than a blind request; VI:L/VA:L reflect the limited integrity/availability effect of writing those stored entries. No EPSS score was provided and the issue is not listed in CISA KEV, so there is no signal of widespread or automated exploitation yet. No SSVC decision data was supplied. The main mitigating factor against raw severity is deployment footprint: YesWiki is a niche product, so even though the technical exploitability is high, the real-world blast radius is narrow. Note the input CVSS is 4.0-only; no CVSS 3.1 vector or EPSS/POC signal was provided, so exploitation likelihood is assessed from the vector and description alone.

An unauthenticated attacker sends a request to the Bazar abonnements sync action supplying a crafted actor URL pointing at an internal host or a cloud metadata endpoint (e.g. 169.254.169.254). The server performs the GET on the attacker's behalf and stores the fetched response as a readable Bazar entry, letting the attacker chain attacker-controlled outbox first/next links and then read back exfiltrated internal data. No public exploit identified at time of analysis.