CVE-2026-104448

YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

7.2 High

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.16%Unchanged since Oct 3, 2026

What each source reports

CVE List Score used 7.2

YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

Record: CVE-2026-104448
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

EUVDEUVD-2026-91459 7.2

Record: EUVD-2026-91459
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6qxf-8854-q5c5 7.2

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage...

Record: GHSA-6qxf-8854-q5c5
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

NVD 7.2

Record: CVE-2026-104448
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSV 7.2

YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

Record: CVE-2026-104448
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-352
Updated: 2026-11-02

Affected products

yeswiki

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-104448 is a high vulnerability (CVSS 7.2) in Yeswiki, published October 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. No source names a fixed version.