CVE-2026-43937 Details

An authorization bypass vulnerability has been identified in YetAnotherForum.NET (YAF.NET) versions prior to 4.0.5. The issue arises because the only admin authorization check is applied after the page handler has executed, allowing low-privileged users to exploit this timing flaw. The most significant impact is found in the '/Admin/RunSql' endpoint, where the 'OnPostRunQuery' handler directly executes SQL commands from the POST body without proper validation. This oversight enables arbitrary SQL execution for users with minimal privileges.

To address this vulnerability, update to YetAnotherForum.NET version 4.0.5 or later. Additionally, convert the 'PageSecurityCheckAttribute' to an 'IAsyncPageFilter' to ensure admin checks are performed before any handler actions. Implement an ASP.NET Core authorization policy for added security, restrict access to the 'RunSql' admin page, and audit other admin authorization logics to prevent similar issues.