---
id: CVE-2026-116204
title: YesWiki before 4.7.0 CSRF via despam Admin Action
summary: >-
  YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in
  the despam action (tools/security/actions/despam.php) that lets
  unauthenticated attackers delete or restore pages through an administrator's
  session. Attackers c…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-352
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki < 4.7.0
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:20:35.206Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116204'
references:
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72'
    label: GitHub Security Advisory (GHSA-cv88-hx5q-vq72)
  - url: >-
      https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-csrf-via-despam-admin-action
    label: 'VulnCheck Advisory: YesWiki before 4.7.0 CSRF via despam Admin Action'
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.939Z'
---

## Overview

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.

## Affected

- `yeswiki < 4.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.