CVE-2026-104467: YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite configuration and list, download, or delete backup archives.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
YesWiki installations before version 4.6.7 are exposed when public API mode is enabled. The affected authorization check can allow unauthenticated requests to admin-only API routes in that configuration.
What could an unauthenticated attacker do through the affected API routes?
An attacker may call routes such as api/ci/update_config to overwrite configuration. They may also use api/archives to list, download, or delete backup archives.
What should be prioritized if immediate patching is not possible?
Disable public API mode to prevent the stated unauthenticated access path to admin-only API routes. Patching to version 4.6.7 or later is needed to address affected versions.