External risk intelligence

YesWiki Unauthenticated Arbitrary Page Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-52766

YesWiki is a web-based wiki application designed to be accessed via a web browser. As a publicly reachable content management system frequently deployed for collaboration, its features, including the vulnerable action, are typically exposed to the internet in common deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the YesWiki system, a PHP-based wiki platform, allows any authenticated user to permanently delete arbitrary wiki pages without proper authorization. This could impact the integrity of information stored on the wiki. The issue has been addressed in version 4.6.6.

Unchecked delete function allows unauthorized page removal.
Impacts wiki data integrity for all users.
Verify wiki system relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can delete any wiki page by exploiting a vulnerability in the comment erasure feature. This action can be triggered through a specially crafted POST request, as there are no authorization checks. The deletion of arbitrary wiki pages, including important administrative content, can lead to a complete disruption of the wiki's functionality and data.

No prior access required.
Triggered by a POST request.
Deletes arbitrary wiki pages.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in YesWiki allows any authenticated user to delete arbitrary wiki pages, including administrative and user-owned content. This can occur when the `EraseSpamedCommentsAction` is triggered without proper authorization checks, which are absent in the affected versions. The impact is the potential loss of all wiki content.

Wiki pages and content.
Any authenticated user can initiate deletion.
Permanent loss of all wiki data.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and application administrators are likely responsible for addressing this vulnerability in the YesWiki system. The immediate first step is to identify all YesWiki instances, confirm their reachability and criticality, and then assign ownership for remediation planning based on the identified risk.

System owners should prioritize this issue.
Verify all YesWiki instances and exposure.
Plan remediation based on criticality and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YesWiki?

YesWiki is a collaborative wiki system built with PHP that allows users to create and manage web-based documentation or shared content. It is designed for community interaction and is frequently used to host collaborative pages where participants can easily edit or contribute information in a structured, web-accessible format.

What does CVE-2026-52766 mean by improper authorization?

This vulnerability involves a missing authorization check, categorized as CWE-862 and CWE-276. In simple terms, the software fails to verify if a user has permission to perform a specific action. Because the system does not confirm rights before processing a deletion request, it mistakenly allows users to remove pages they are not authorized to touch.

How is this deletion vulnerability triggered?

The issue occurs when the specific wiki action intended for erasing spam comments receives a crafted request containing a list of page identifiers. The system processes this request by deleting every page matching those identifiers. It is important to note that simply visiting the site or reading pages does not trigger this; the action requires a specific POST request.

Is my YesWiki instance at risk?

According to Halo Surface Signal, YesWiki is typically deployed as a publicly reachable content management system. If your instance is accessible from the internet, it is likely exposed to this risk. Because YesWiki often defaults to allowing page write access to all users, internal and external instances that haven't restricted permissions may be affected.

How do I secure my installation?

The primary step is to identify all instances of YesWiki running within your environment to determine which are active and reachable. Once identified, you should prioritize updating your software to version 4.6.6 or later, as this release includes the necessary checks to prevent unauthorized page deletion.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.