YesWiki: Authorization bypass via public API mode

Summary

YesWiki before 4.6.7 contains an authorization bypass in the central API access check. If the documented public API mode is enabled, unauthenticated attackers can call admin-only API routes. They can overwrite the configuration and list, download or delete backup archives. Public API mode is not confirmed as the default setting.

Affected

• YesWiki versions before 4.6.7 (the CNA record and the vendor advisory list versions up to 4.6.6)
• Only relevant when public API mode ('api_allowed_keys' => ['public' => true]) is enabled

Fixed in

• 4.6.7 (vendor advisory)

Workaround

• Disable public API mode by removing 'api_allowed_keys' => ['public' => true] from the configuration.
• Restrict access to the wiki to the internal network until the update is applied.

Exploitation

• CISA SSVC assessment: exploitation 'poc', not automatable.
• The vendor advisory describes the vulnerable routes and includes curl-based proof-of-concept requests.
• No evidence of exploitation in the wild was found in the sources. The CISA KEV catalogue was not checked directly.

Our recommendation

• Verify the installed version and upgrade to 4.6.7 or later.
• Check whether public API mode is enabled and disable it if it is not required.
• Review web server logs for unauthenticated requests to /api routes.
• Check the configuration and backups for unexpected changes, and rotate secrets stored in the configuration if tampering is found.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-v527-6r4j-j2w2 github.com
• VulnCheck advisory: YesWiki before 4.6.7 Authorization Bypass via Public API Mode www.vulncheck.com
• Vulners CVE record CVE-2026-104467 (CNA data) vulners.com
• OSV: CVE-2026-104467 osv.dev
• OpenCVE: CVE-2026-104467 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:56.