Yii2 Starter Kit CVE-2026-103476

Exploitation targets the attachment-download endpoint in frontend/controllers/ArticleController.php of yii2-starter-kit through 4.2.0, which fails to verify the parent article's publication (draft/published) status before serving the file. The only prerequisite is network reachability of a deployed site running the vulnerable download action; no authentication, no user interaction, and no non-default configuration are required. Exploitation is aided by sequential/predictable attachment identifiers that allow enumeration. LIMITING FACTORS: impact is confined to reading attachment files of unpublished articles (confidentiality only - no write, modification, or DoS), and real-world exposure depends on a site actually being built from this starter kit with the vulnerable controller unmodified.

This is a genuine but moderate-severity information-disclosure flaw whose real-world risk is capped by both scope and prevalence. The signals are consistent rather than conflicting: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, 6.9) correctly reflects remote, network-based, unauthenticated exploitation with low complexity but only LOW confidentiality impact and zero integrity/availability impact - matching the description of an IDOR (CWE-639) that leaks draft-article attachment files. The 'unauthenticated' qualifier is confirmed by PR:N in the provided vector. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis'; the flaw is trivially exploitable (sequential ID enumeration) but there is no evidence of active exploitation. The dominant risk-limiting factor is prevalence: yii2-starter-kit is a developer boilerplate/scaffolding project rather than a mass-deployed product, so exposure is confined to sites built on and shipped with the vulnerable ArticleController download logic. Net: a real, easy-to-exploit issue for affected deployments, but low aggregate risk versus a high-CVSS-but-widespread flaw. Note the vendor CVSS 4.0 base scores 6.9 while an equivalent CVSS 3.1 base lands around 5.3 (Medium); the difference is scoring-methodology, not a data conflict.

An unauthenticated attacker requests the public attachment-download endpoint (frontend/controllers/ArticleController.php) and iterates sequential attachment identifiers. Because the endpoint never checks the parent article's publication status, the server returns files attached to draft/unpublished articles, exposing embargoed or pre-release content. No POC is published in the provided sources, but exploitation requires only a scripted loop of HTTP GET requests.