YesWiki versions prior to 4.6.7 are vulnerable to a second-order SQL injection that occurs when a stored username is concatenated into a LIKE clause without proper escaping in the AclService::updateRequestWithACL function. An attacker can craft a username containing a double‑quote payload, register an account, and then view ACL‑filtered content. The injected string is later used to evaluate database queries, allowing the attacker to read arbitrary database records and bypass read‑ACL restrictions. The vulnerability is a classic injection flaw (CWE‑89) that can expose sensitive data.

The flaw affects all YesWiki installations running version 4.6.7 or earlier. No specific sub‑version ranges are listed, so any deployment where the core code matches the affected versions is at risk until the vendor releases a patch or upgrade.

The CVSS score of 7.2 reflects a high‑impact vulnerability that can be exploited remotely through the web interface, as an attacker can self‑register and inject malicious input. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread documented exploitation yet. Nevertheless, the attack vector is remote, and the payload is trivial to supply, so the risk remains significant for exposed installations.