---
cve: "CVE-2026-104439"
severity: "HIGH"
cvss: 7.1
epss: "0.3%"
vendor: "YesWiki"
kev: false
exploited: false
published: "2026-10-02 12:17:14"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-28T09:15:05+01:00"
---

# CVE-2026-104439

> 7.1 HIGH · 🧪 PoC

## Beschreibung

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-02 13:31:48
- CNA-CVSS: **7.1** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-204** — Observable Response Discrepancy
  The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

## Angriffsmuster (CAPEC)

- [CAPEC-331 — ICMP IP Total Length Field Probe](https://capec.mitre.org/data/definitions/331.html) _(Severity: Low)_
- [CAPEC-332 — ICMP IP 'ID' Field Error Message Probe](https://capec.mitre.org/data/definitions/332.html) _(Severity: Low)_
- [CAPEC-541 — Application Fingerprinting](https://capec.mitre.org/data/definitions/541.html) _(Severity: Low)_
- [CAPEC-580 — System Footprinting](https://capec.mitre.org/data/definitions/580.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1592.002 — Gather Victim Host Information: Software](https://attack.mitre.org/techniques/T1592/002/)
- [T1082 — System Information Discovery](https://attack.mitre.org/techniques/T1082/)

## Patch verfügbar (OSV)

- 07120ed8971047f504f7ec78060828f1895f475f

## Referenzen

- <https://github.com/YesWiki/yeswiki/security/advisories/GHSA-892r-45m6-45xc>
- <https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-user-enumeration-via-lost-password-flow>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-104439/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_