CVE-2026-116821
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 27, 2026
Vendor
unknown
Description
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.