[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-52766":6},{"stargazers_count":4,"fetched_at":5},7,"2026-09-05T03:56:46.258Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":305,"aliases":306,"duplicate_of":9,"upstream":307,"downstream":308,"duplicates":309,"related":310,"reserved_at":9,"published_at":311,"modified_at":311,"state":312,"summary":313,"references_raw":322,"kevs":338,"epss":339,"epss_history":342,"metrics":344,"affected":352},"CVE-2026-52766","YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.",null,[11,131],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-276","Incorrect Default Permissions","During installation, installed file permissions are set to allow anyone to modify those files.","weakness","Draft","Base","Medium",[20,68,127],{"id":21,"name":22,"techniques":23},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[24],{"id":25,"name":26,"tactics":27,"countermeasures":43},"T1574.010","Services File Permissions Weakness",[28,31,34,37,40],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",{"id":35,"name":36},"TA0030","Defense Evasion",{"id":38,"name":39},"TA0005","Stealth",{"id":41,"name":42},"TA0104","Execution",[44,49,54,59,63],{"id":45,"name":46,"tactic":47},"D3-RS","Restore Software",{"name":48},"Restore",{"id":50,"name":51,"tactic":52},"D3-SWI","Software Inventory",{"name":53},"Model",{"id":55,"name":56,"tactic":57},"D3-SBV","Service Binary Verification",{"name":58},"Detect",{"id":60,"name":61,"tactic":62},"D3-AVE","Asset Vulnerability Enumeration",{"name":53},{"id":64,"name":65,"tactic":66},"D3-SU","Software Update",{"name":67},"Harden",{"id":69,"name":70,"techniques":71},"CAPEC-127","Directory Indexing",[72],{"id":73,"name":74,"tactics":75,"countermeasures":79},"T1083","File and Directory Discovery",[76],{"id":77,"name":78},"TA0102","Discovery",[80,85,89,94,98,102,106,110,114,118,122],{"id":81,"name":82,"tactic":83},"D3-CQ","Content Quarantine",{"name":84},"Isolate",{"id":86,"name":87,"tactic":88},"D3-FE","File Encryption",{"name":67},{"id":90,"name":91,"tactic":92},"D3-DF","Decoy File",{"name":93},"Deceive",{"id":95,"name":96,"tactic":97},"D3-FA","File Analysis",{"name":58},{"id":99,"name":100,"tactic":101},"D3-FIM","File Integrity Monitoring",{"name":58},{"id":103,"name":104,"tactic":105},"D3-LFP","Local File Permissions",{"name":84},{"id":107,"name":108,"tactic":109},"D3-CF","Content Filtering",{"name":84},{"id":111,"name":112,"tactic":113},"D3-RFAM","Remote File Access Mediation",{"name":84},{"id":115,"name":116,"tactic":117},"D3-RF","Restore File",{"name":48},{"id":119,"name":120,"tactic":121},"D3-CM","Content Modification",{"name":84},{"id":123,"name":124,"tactic":125},"D3-FEV","File Eviction",{"name":126},"Evict",{"id":128,"name":129,"techniques":130},"CAPEC-81","Web Server Logs Tampering",[],{"_key":132,"id":132,"name":133,"description":134,"type":15,"status":135,"abstraction":136,"likelihood_of_exploit":137,"capec":138},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","Incomplete","Class","High",[139],{"id":140,"name":141,"techniques":142},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[143,174,202],{"id":144,"name":145,"tactics":146,"countermeasures":149},"T1211","Exploitation for Stealth",[147,148],{"id":35,"name":36},{"id":38,"name":39},[150,154,158,162,166,170],{"id":151,"name":152,"tactic":153},"D3-PSEP","Process Segment Execution Prevention",{"name":67},{"id":155,"name":156,"tactic":157},"D3-MBT","Memory Boundary Tracking",{"name":58},{"id":159,"name":160,"tactic":161},"D3-PCSV","Process Code Segment Verification",{"name":58},{"id":163,"name":164,"tactic":165},"D3-SFCV","Stack Frame Canary Validation",{"name":67},{"id":167,"name":168,"tactic":169},"D3-SSC","Shadow Stack Comparisons",{"name":58},{"id":171,"name":172,"tactic":173},"D3-SAOR","Segment Address Offset Randomization",{"name":67},{"id":175,"name":176,"tactics":177,"countermeasures":181},"T1542.002","Component Firmware",[178,179,180],{"id":35,"name":36},{"id":38,"name":39},{"id":29,"name":30},[182,186,190,194,196,198,200],{"id":183,"name":184,"tactic":185},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":58},{"id":187,"name":188,"tactic":189},"D3-FV","Firmware Verification",{"name":58},{"id":191,"name":192,"tactic":193},"D3-FBA","Firmware Behavior Analysis",{"name":58},{"id":64,"name":65,"tactic":195},{"name":67},{"id":50,"name":51,"tactic":197},{"name":53},{"id":45,"name":46,"tactic":199},{"name":48},{"id":60,"name":61,"tactic":201},{"name":53},{"id":203,"name":204,"tactics":205,"countermeasures":214},"T1556","Modify Authentication Process",[206,207,210,211],{"id":35,"name":36},{"id":208,"name":209},"TA0112","Defense Impairment",{"id":29,"name":30},{"id":212,"name":213},"TA0031","Credential Access",[215,217,221,223,227,231,233,237,241,245,249,253,257,259,261,263,265,267,271,275,277,281,285,287,289,293,297,301],{"id":103,"name":104,"tactic":216},{"name":84},{"id":218,"name":219,"tactic":220},"D3-HBPI","Hardware-based Process Isolation",{"name":84},{"id":123,"name":124,"tactic":222},{"name":126},{"id":224,"name":225,"tactic":226},"D3-HS","Host Shutdown",{"name":126},{"id":228,"name":229,"tactic":230},"D3-PSMD","Process Self-Modification Detection",{"name":58},{"id":81,"name":82,"tactic":232},{"name":84},{"id":234,"name":235,"tactic":236},"D3-ABPI","Application-based Process Isolation",{"name":84},{"id":238,"name":239,"tactic":240},"D3-SFA","System File Analysis",{"name":58},{"id":242,"name":243,"tactic":244},"D3-PT","Process Termination",{"name":126},{"id":246,"name":247,"tactic":248},"D3-SCF","System Call Filtering",{"name":84},{"id":250,"name":251,"tactic":252},"D3-AM","Access Modeling",{"name":53},{"id":254,"name":255,"tactic":256},"D3-RC","Restore Configuration",{"name":48},{"id":86,"name":87,"tactic":258},{"name":67},{"id":90,"name":91,"tactic":260},{"name":93},{"id":99,"name":100,"tactic":262},{"name":58},{"id":107,"name":108,"tactic":264},{"name":84},{"id":95,"name":96,"tactic":266},{"name":58},{"id":268,"name":269,"tactic":270},"D3-WSAM","Web Session Access Mediation",{"name":84},{"id":272,"name":273,"tactic":274},"D3-CI","Configuration Inventory",{"name":53},{"id":115,"name":116,"tactic":276},{"name":48},{"id":278,"name":279,"tactic":280},"D3-PSA","Process Spawn Analysis",{"name":58},{"id":282,"name":283,"tactic":284},"D3-PLA","Process Lineage Analysis",{"name":58},{"id":111,"name":112,"tactic":286},{"name":84},{"id":119,"name":120,"tactic":288},{"name":84},{"id":290,"name":291,"tactic":292},"D3-NTPM","Network Traffic Policy Mapping",{"name":53},{"id":294,"name":295,"tactic":296},"D3-KBPI","Kernel-based Process Isolation",{"name":84},{"id":298,"name":299,"tactic":300},"D3-PS","Process Suspension",{"name":126},{"id":302,"name":303,"tactic":304},"D3-HR","Host Reboot",{"name":126},[],[],[],[],[],[],"2026-09-04T23:40:12.087Z","Received",{"cisa_kev":314,"cisa_ransomware":314,"cisa_vendor":9,"epss_severity":315,"epss_score":316,"severity":317,"severity_score":318,"severity_version":319,"severity_source":320,"severity_vector":321,"severity_status":312},false,"low",0.00052,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",[323,329,334],{"url":324,"sources":325,"tags":327},"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x",[320,326],"nvd",[328],"X Refsource CONFIRM",{"url":330,"sources":331,"tags":332},"https://github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abef",[320,326],[333],"X Refsource MISC",{"url":335,"sources":336,"tags":337},"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6",[320,326],[333],[],{"date":340,"score":316,"percentile":341},"2026-06-14",0.16866,[343],{"date":340,"score":316,"percentile":341},[345,350],{"source":320,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":346,"cvss_v4_0":9},{"baseScore":318,"baseSeverity":347,"vectorString":321,"impactScore":348,"exploitabilityScore":349},"CRITICAL",8.7,10,{"source":326,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":351,"cvss_v4_0":9},{"baseScore":318,"baseSeverity":347,"vectorString":321,"impactScore":348,"exploitabilityScore":349},[353],{"ecosystem":9,"name":354,"vendor":354,"product":354,"cpe_part":355,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":356},"yeswiki","a",[357],{"version":358,"is_range":359,"range_type":320,"version_start":9,"version_start_type":9,"version_end":360,"version_end_type":361,"fixed_in":9},"\u003C 4.6.6",true,"4.6.6","excluding"]