CVE-2026-52766

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

• CWE-276
• CWE-862

• https://github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abef
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x

Published

Sep 5, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52759Ghidra before 12.1.1 contains an uncontrolled memory allocat…6.7
• CVE-2026-5276Insufficient policy enforcement in WebUSB in Google Chrome p…6.5
• CVE-2026-52760Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-52761ModSecurity is an open source, cross platform web applicatio…5.3
• CVE-2026-52762YesWiki is a wiki system written in PHP. Prior to version 4.…7.1
• CVE-2026-52763YesWiki is a wiki system written in PHP. Prior to version 4.…6.5
• CVE-2026-52767YesWiki is a wiki system written in PHP. From version 4.6.2 …8.2
• CVE-2026-52769YesWiki is a wiki system written in PHP. From version 4.6.2 …8.3
• CVE-2026-5277Integer overflow in ANGLE in Google Chrome on Windows prior …7.5
• CVE-2026-52770YesWiki is a wiki system written in PHP. Prior to version 4.…7.5
• CVE-2026-52771YesWiki is a wiki system written in PHP. From version 4.2.0 …8.3
• CVE-2026-52772YesWiki is a wiki system written in PHP. Prior to version 4.…5.5