CVE-2026-116821

🎯 CVE-2026-116821 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-116821 | YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.

Klassifikation & Betroffenheit:

CWE-89 YesWiki yeswiki 0 <4.7.0

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 🎯 High

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as…

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used proper…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-7 · Blind SQL Injection (High) CAPEC-66 · SQL Injection (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-109 · Object Relational Mapping Injection (High) CAPEC-110 · SQL Injection through SOAP Parameter Tam… (Very High) CAPEC-470 · Expanding Control over the Operating Sys… (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-104471 8.6 CVE-2026-15829 8.6 CVE-2025-67736 8.6 CVE-2025-10655 8.6 CVE-2025-62173 8.6

🩹 Patch verfügbar (OSV):

🩹 bba4abccdf68476dde3d7119019139121849fb32 🩹 f3b0dd093a7ace47dc29a515faeb02635baceae2

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 29.10.

CVSS-Vektor-Analyse: 7.1

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CNA-Bewertung (VulnCheck): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA…

Veröffentlicht:27.10.2026

Aktualisiert:27.10.2026 00:17

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-110528

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-89 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	742	0,2 %
≥50 %	3.215	0,8 %
≥10 %	22.060	5,8 %
<10 %	354.712	93,2 %

7.1 HIGH

EPSS

CVE-2026-116821 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

YesWiki

CVE-2026-116821 | YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.

CWE-89 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 2 Tagen

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub