Description
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| YesWiki | yeswiki | < 4.7.0 | 4.7.0 |
References
- GitHub Security Advisory (GHSA-q5j6-79p7-mp94) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames third-party-advisory