EUVD-2026-91478
GHSA-59xh-vh54-x5hf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify YesWiki with public API mode
-
DeliverySend unauthenticated request to admin API route
-
ExploitBypass ApiService::isAuthorized() check
-
ExecutionCall api/ci/update_config or api/archives
-
ImpactOverwrite config and exfiltrate/delete backups
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target YesWiki instance has 'public API mode' enabled - this is the exact feature-level precondition named in the description and is reflected by AT:P in the CVSS 4.0 vector. When that mode is on, no authentication, privileges, or user interaction are needed: an unauthenticated remote attacker can reach admin-only routes (e.g. api/ci/update_config, api/archives) because ApiService::isAuthorized() does not enforce authorization. The principal limiting factor is that public API mode is a non-default administrative configuration; instances that have not enabled it are not exploitable through this path. Affected versions are all releases before 4.6.7. |
| Impact | This is a genuine high-priority issue, not merely a high-CVSS inflation. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, low-complexity network exploitation with full High impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), reflecting the ability to overwrite configuration and list/download/delete backup archives via CWE-862 missing authorization. The single most important mitigating signal is AT:P (Attack Requirements: Present): exploitation is gated on YesWiki running with 'public API mode enabled,' which is a non-default deployment choice - this materially narrows the exposed population. No EPSS score was supplied and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; the correct status is no public exploit identified at time of analysis. The flaw was reported by VulnCheck and a vendor advisory (GHSA) plus patch exist. Overall: credible, easily weaponizable against affected configurations and worth prompt patching, but real-world risk is bounded by (a) the non-default public-API precondition and (b) YesWiki's modest deployment footprint rather than by exploit difficulty. The 9.2 score should be read as conditional on public API mode being on. |
| Exploit ScenarioDerived | An attacker discovers a YesWiki instance (before 4.6.7) with public API mode enabled and sends unauthenticated HTTP requests directly to admin-only endpoints such as api/ci/update_config and api/archives. Because ApiService::isAuthorized() fails to enforce authorization, the attacker overwrites site configuration and downloads or deletes backup archives. No public proof-of-concept exploit was identified in the provided data, but the attack is low-complexity and requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Authorization bypass in YesWiki before 4.6.7 lets unauthenticated remote attackers call admin-only API routes when the instance has public API mode enabled, enabling configuration overwrites via api/ci/update_config and listing, downloading, or deleting backup archives via api/archives. The vulnerability is a missing-authorization flaw in ApiService::isAuthorized(), rated 9.2 under CVSS 4.0 but with a significant prerequisite: public API mode is a non-default administrative setting, so default installations are not exploitable through this path. No public exploit code or confirmed active exploitation is identified in the available intelligence, but the impact is high for exposed instances and patching to 4.6.7 is the primary fix.
RemediationAI
Vendor-released patch: YesWiki 4.6.7. Upgrade to 4.6.7 or later. If upgrade cannot be done immediately, disable public API mode, which removes the required precondition but will break any legitimate public API clients. If public API mode must remain enabled, restrict access to the affected API routes such as api/ci/update_config and api/archives at a reverse proxy or WAF to trusted administrative networks or IPs, accepting that legitimate remote API consumers may be blocked; review configuration and backup archives for unauthorized changes and monitor logs for calls to those endpoints. Refer to the vendor advisory https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v527-6r4j-j2w2 and the VulnCheck advisory https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-authorization-bypass-via-public-api-mode for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YesWiki before 4.6.7 exposes API routes that are meant to be admin-only, but ApiService::isAuthorized() fails to enforce authorization correctly; this corresponds to CWE-862 Missing Authorization. The CVSS 4.0 vector contains PR:N, confirming unauthenticated access, and AT:P, indicating that exploitation requires the non-default public API mode to be enabled; our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the same high confidentiality, integrity, and availability impact with elevated attack complexity because of that prerequisite. Vulnerable routes include api/ci/update_config, which can overwrite configuration, and api/archives, which can list, download, or delete backup archives. The CPE cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* and EUVD range 0 <4.6.7 identify all releases before 4.6.7 as affected.
Know when Yeswiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network attack (PR:N/AV:N), but the required non-default public-API-mode configuration maps the 4.0 AT:P requirement to AC:H in 3.1; full config/backup compromise gives C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.
Technical POC Analysis
CWE-862 Missing Authorization in includes/services/ApiService.php, function ApiService::isAuthorized().
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
YesWiki instances that have the non-default public API mode enabled are exposed to a critical authorization bypass (CVE-2026-104467) that lets remote attackers reach administrative API routes, overwrite instance configuration, and list, download, or delete backup archives. Successful abuse can result in full control of the affected site and exposure of any sensitive data held in those backups, which is why leadership should prioritize identifying and remediating internet-facing instances managed by their teams. Default installations do not expose this path, and no public exploit has been identified at time of analysis, so the risk is concentrated in a specific, discoverable configuration rather than across the entire estate.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
YesWiki is a wiki system written in PHP. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no
YesWiki is a wiki system written in PHP. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable
Remote code execution in YesWiki prior to 4.6.6 allows unauthenticated attackers to inject arbitrary PHP via the Bazar C
YesWiki is a wiki system written in PHP. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable,
YesWiki is a wiki system written in PHP. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no
YesWiki is a wiki system written in PHP. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, n
YesWiki is a wiki system written in PHP. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, n
Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted pa
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered para
Unauthenticated attackers can delete or overwrite federated entries in YesWiki instances before 4.6.7 that have Activity
Unauthenticated SQL injection in YesWiki before 4.6.7 allows remote attackers to read arbitrary database contents, inclu
Authenticated SQL injection in YesWiki bazar module allows low-privileged users to execute arbitrary SQL queries against
Exploit-DB