PT-2026-104277
CVE-2026-104467
·
تاريخ النشر
2026-10-02
·
تاريخ التحديث
2026-10-02
الوصف من
CVSS 4.0
9.2
حرجةالمقاييسAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
YesWiki versions prior to 4.6.7
Description
An authorization bypass exists in the
isAuthorized() function of the ApiService when public API mode is enabled. This allows unauthenticated attackers to access administrative API routes. Specifically, attackers can interact with the 'api/ci/update config' and 'api/archives' endpoints to overwrite system configurations or list, download, and delete backup archives.Recommendations
Update YesWiki to version 4.6.7 or later.
As a temporary mitigation, disable the public API mode to prevent unauthorized access to the
isAuthorized() function.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾