CVE-2026-103476: yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of yii2-starter-kit through version 4.2.0 are exposed when they contain attachments associated with unpublished or draft articles. The affected attachment-download endpoint can be reached without authentication.
What does an attacker need to exploit it?
An attacker needs only network access to the application and attachment identifiers. Because identifiers can be sequentially enumerated, no account, authorization, or user interaction is required.
What information can be accessed?
An attacker can download files attached to draft or otherwise unpublished articles. The issue affects confidentiality; the provided data does not indicate modification or service-disruption impact.
How can I assess whether files may already have been exposed?
Review access logs for unauthenticated requests to the attachment-download endpoint, particularly requests covering many sequential attachment identifiers. Compare requested attachment IDs with attachments belonging to unpublished articles.