CVE-2026-104444
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Oct 02, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.