{"id":"CVE-2026-104472","published":"2026-10-02T12:17:20.197","lastModified":"2026-10-02T15:17:08.533","description":"YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7cj2-9pgf-vcw2","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-missing-authorization-via-attachment-download-handler","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7cj2-9pgf-vcw2","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7cj2-9pgf-vcw2","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7cj2-9pgf-vcw2","tags":[]}],"hasPoc":true,"ai":{"summary":"A missing authorization check in YesWiki's attachment download handler allows unauthenticated attackers to access confidential files from pages that should be restricted to specific users or groups. This vulnerability enables unauthorized data disclosure without requiring any authentication credentials.","exploitability":"The exploit is straightforward and requires no special preconditions - attackers simply need to know a valid page tag and file name to access restricted attachments, making it highly exploitable in environments where page names are guessable or discoverable.","blast_radius":"In a typical deployment, this vulnerability could expose sensitive documents, images, or other attachments from read-restricted pages, potentially leading to unauthorized disclosure of confidential information that should only be accessible to authorized users.","remediation":"Upgrade to YesWiki 4.6.7 or later to address this missing authorization vulnerability in the attachment download handler.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","file-download","web-application"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:03:05.886Z"}}