{"id":"CVE-2026-104456","published":"2026-10-02T12:17:17.490","lastModified":"2026-10-02T15:17:07.693","description":"YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rw5-62xf-q5xp","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-second-order-sql-injection-via-acl-username","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rw5-62xf-q5xp","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rw5-62xf-q5xp","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rw5-62xf-q5xp","tags":[]}],"hasPoc":true,"ai":{"summary":"A second-order SQL injection vulnerability in YesWiki allows attackers to bypass read access controls by registering a specially crafted username containing double-quote characters, which then gets used unescaped in database queries. This enables attackers to read sensitive database contents and circumvent ACL restrictions.","exploitability":"Exploitation requires a self-registration capability and involves crafting a username with double-quote payload that gets stored and later used in an unescaped LIKE clause, making it moderately difficult but achievable for attackers with registration access.","blast_radius":"If exploited, this vulnerability could allow attackers to read sensitive database information and bypass read ACLs across the entire YesWiki instance, potentially exposing private content and user data.","remediation":"Upgrade to YesWiki 4.6.7 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","acl-bypass","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:52:42.845Z"}}