CVE-2026-104453
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Oct 02, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.