CVE-2026-104439

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-104439

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104439.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-104439

Aliases

GHSA-892r-45m6-45xc

Published

2026-10-02T11:38:15Z

Modified

2026-10-04T02:46:35Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

Details

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-204"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104439.json"
}

References

Affected packages

Git / github.com/yeswiki/yeswiki

Affected ranges

Type

GIT

Repo

https://github.com/yeswiki/yeswiki

Events

Introduced

Fixed

07120ed8971047f504f7ec78060828f1895f475f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.6.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v4.*

v4.1.0

v4.1.5

v4.2.0

v4.2.1

v4.2.2

v4.3.0

v4.3.1

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.5.1

v4.5.2

v4.5.3

v4.5.4

v4.5.5

v4.6.0

v4.6.2

v4.6.3

v4.6.4

v4.6.5

v4.6.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104439.json"