YesWiki: Missing authorization in attachment download handler
Summary
YesWiki before 4.6.7 contains a missing authorization check in the attachment download handler. An unauthenticated attacker who knows or guesses a page tag and attachment filename can download files attached to pages whose read access is restricted by YesWiki ACLs. Only confidentiality is affected; integrity and availability are not. The handler is reachable by default unless module permissions are explicitly restricted.
Affected
- YesWiki versions before 4.6.7 (CNA record: 0 to < 4.6.7; GHSA advisory: <= 4.6.6)
- Oldest affected version: Unknown.
Fixed in
- Fixed in YesWiki 4.6.7.
Workaround
- Unknown. No documented workaround was found. Upgrading to 4.6.7 or later is the practical fix.
Exploitation
- Not confirmed as exploited in the wild; not listed in the CISA KEV catalogue.
- CISA SSVC: exploitation 'poc', automatable 'yes'.
- The GHSA advisory describes a request that reproduces the flaw, so a public proof of concept is likely.
Our recommendation
- Identify all YesWiki instances and their versions.
- Upgrade every instance older than 4.6.7 to 4.6.7 or later.
- Check whether restricted pages hold sensitive attachments and whether the download handler is reachable from the internet.
- Review web server and access logs for unauthenticated requests to the attachment download handler.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7cj2-9pgf-vcw2 github.com
- VulnCheck advisory: YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler www.vulncheck.com
- YesWiki 4.6.7 release github.com
- OSV: CVE-2026-104472 osv.dev
- OpenCVE: CVE-2026-104472 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:57.
Original description (NVD)
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.