{"id":"CVE-2026-104467","published":"2026-10-02T12:17:19.373","lastModified":"2026-10-02T16:16:46.357","description":"YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v527-6r4j-j2w2","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-authorization-bypass-via-public-api-mode","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v527-6r4j-j2w2","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v527-6r4j-j2w2","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v527-6r4j-j2w2","tags":[]}],"hasPoc":true,"ai":{"summary":"YesWiki before 4.6.7 allows unauthenticated attackers to bypass authorization and call admin-only API routes, potentially leading to configuration overwrites and data manipulation.","exploitability":"Exploitation is relatively straightforward as it requires enabling public API mode and sending specific API requests, which can be automated.","blast_radius":"If exploited, attackers could overwrite critical configurations, list, download, or delete backup archives, leading to significant data loss or system compromise.","remediation":"Upgrade to YesWiki 4.6.7 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:27.190Z"}}