CVE-2026-104439
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that…
- Risk score
- 47/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targete…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.6.7 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: php
References
Original description
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
Last activity 2 Oct 2026. Patch Forecast updates every hour.