CVE-2026-104438
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 02, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.