Is CVE-2026-104453 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104453?

CVE-2026-104453 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-104453

Description

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.