Is CVE-2026-104444 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104444?

CVE-2026-104444 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-104444

Description

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.