Summary
YesWiki contains an authorization bypass in the comments API that can let an authenticated, low-privilege user modify pages or comments they should not control. The issue becomes risky when the API trusts a user-supplied page tag to identify the target without consistently enforcing the target page's write permissions.
Affected context
The vulnerability occurs in YesWiki deployments where the comments API editComment route processes user-controlled page identifiers and does not reliably apply authorization checks to the referenced target. Affected operations may permit changes to pages or comments outside the authenticated user's permitted scope, including content replacement or changes to existing parent-child relationships.
Exploit preconditions
- Attack surface: The YesWiki comments API, specifically the comment-editing route
- Required access: An authenticated account with otherwise limited privileges
- Trigger point: Processing an edit request that references a target page or comment through a user-controlled page tag
- Why exploitation is possible: Authorization is evaluated against attacker-controlled context rather than being enforced against the actual target resource and its page-level write ACL
Why this happens
The underlying bug is an authorization design failure involving a user-controlled resource reference. The application accepts a supplied page tag and fails to establish that the authenticated user has write permission for the referenced page or comment before applying the requested change. This maps to CWE-639: Authorization Bypass Through User-Controlled Key, because access control decisions rely on an identifier supplied by the requester instead of a server-validated authorization context.
Potential impact
- Unauthorized replacement of page or comment content
- Defacement or loss of legitimate user-generated material
- Reparenting of pages or comments to alter site structure
- Integrity violations across pages outside the user's intended scope
- Possible disruption of workflows that depend on trusted page content
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the server-side resource boundary rather than trusting identifiers supplied by clients.
Common defensive patterns include:
- Resolve the target resource server-side and verify its current page-level write ACL before any modification
- Apply authorization checks consistently to both direct targets and related parent resources
- Avoid deriving access decisions from attacker-controlled page tags or similar keys
- Use deny-by-default permissions and least-privilege roles for authenticated users
- Keep authorization checks close to the data mutation and make them consistent across API routes
- Record ownership and authorization-relevant relationships in trusted server-side state
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for authorization decisions based directly on request parameters
- Review of API handlers that accept page tags, object identifiers, or parent references
- Tests that attempt cross-page updates using accounts with different permission scopes
- Monitoring for unusual edits affecting pages outside an account's normal activity
- Policy enforcement requiring object-level authorization checks before every update and relationship change
- Automated security testing or review tools that identify missing access-control checks and insecure direct object references
