YesWiki versions prior to 4.6.7 contain an empty‑filter scope bypass in the triples delete API. An authenticated user can craft a delete request with an empty filter and remove any semantic triple, including those that grant admin privileges or link users to the admin group. This allows an attacker to delete the admin group membership triple, thereby disabling all administrator accounts and causing a site‑wide authorization lockout. The flaw also permits forging new triples with elevated permissions, enabling persistent tampering with content and access controls.

The vulnerability affects all releases of YesWiki before 4.6.7, including every build that does not include the patch found in version 4.6.7 and later. Any installation of the YesWiki application before that version is subject to this issue.

The CVSS score is 7.2, indicating a high severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The flaw is not listed in CISA’s KEV catalog. Because the CVE description states that any authenticated user can exploit the issue, it is inferred that the attack vector is an authenticated network session. Once authenticated, the attacker can immediately send the crafted delete request and alter or delete critical access triples, leading to privilege escalation or complete denial of service for administrative functions.