CVE-2026-52766

YesWiki versions prior to 4.6.6 fail to enforce authorization in the {{erasespamedcomments}} action (actions/EraseSpamedCommentsAction.php), which accepts a suppr[] array via POST and deletes every wiki page whose tag appears in that array, with no permission check in the action body or in the page-deletion path it invokes. Because YesWiki's action ACL model is allow-by-default and a fresh install grants page write access to everyone (default_write_acl='*'), any user with write access can trigger the action and permanently delete arbitrary pages, including the front page, admin pages, and pages owned by other users; the CVSS 3.1 vector (9.1 Critical) scores it as network-exploitable with no privileges required, with high integrity and availability impact and no confidentiality impact. An attacker who can reach the action therefore gains permanent, unlogged-in-effect deletion of arbitrary wiki content. All self-hosted YesWiki deployments running any version before 4.6.6 are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade to YesWiki 4.6.6 or later. As an interim mitigation, tighten page write ACLs (default_write_acl) and restrict use of the erasespamedcomments action to trusted users only. Review wiki pages for unexpected deletions and ensure backups exist, since deleted pages are permanently lost.