CVE-2026-43937

HIGH

YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`

Title source: cna
STIX 2.1

Description

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0003
EPSS Percentile 8.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-841 CWE-89
Status published
Products (2)
nuget/YAFNET.Core 0 - 4.0.5NuGet
YAFNET/YAFNET < 4.0.5
Published May 12, 2026
Tracked Since May 12, 2026