---
id: CVE-2026-116820
title: YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
summary: >-
  YesWiki from 4.6.0 before 4.7.0 contains an information disclosure
  vulnerability that allows unauthenticated attackers to view assembled SQL
  queries by adding the showreq parameter. Attackers can append showreq to
  public Bazar listing AP…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-215
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki >= 4.6.0 < 4.7.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T23:05:47.054Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116820'
references:
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm'
    label: GitHub Security Advisory (GHSA-98mc-h829-5hwm)
  - url: >-
      https://www.vulncheck.com/advisories/yeswiki-from-4.6.0-before-4.7.0-sql-query-disclosure-via-showreq-parameter
    label: >-
      VulnCheck Advisory: YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure
      via showreq Parameter
tags:
  - cve.org
epss: 0.00231
epssPercentile: 0.13858
ingestedAt: '2026-10-27T16:11:59.151Z'
---

## Overview

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

## Affected

- `yeswiki >= 4.6.0 < 4.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.