{"affected":[{"defaultStatus":"unaffected","product":"yeswiki","source":"CNA: VulnCheck","vendor":"YesWiki","versions":[{"lessThan":"4.7.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.7.0","versionType":"semver"}]}],"cveId":"CVE-2026-116821","cwes":["CWE-89"],"description":"YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.","epss":{"date":"2026-11-02","percentile":0.2035,"score":0.00279},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-q5j6-79p7-mp94"}],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.5,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793645158730,"publishedAt":1793055947763,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-q5j6-79p7-mp94"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/YesWiki/yeswiki/commit/f3b0dd093a7ace47dc29a515faeb02635baceae2"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-read-acl-bypass-via-sql-like-wildcards-in-usernames"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-q5j6-79p7-mp94"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/YesWiki/yeswiki/commit/f3b0dd093a7ace47dc29a515faeb02635baceae2"}],"revision":"23711e43c04089cfd63b4ff64feb3396ae3dfbf9658f430c56f7c427c16f65ea","sources":[{"modifiedAt":1793645158730,"name":"CNA: VulnCheck","retrievedAt":1793646536604,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116821"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793646541560,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116821"}],"ssvc":{"assessedAt":1793645140164,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames","updatedAt":1793646541560}