CVE-2026-104472

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description A missing authorization issue exists in the attachment download handler. This allows unauthenticated attackers to bypass page read Access Control Lists (ACLs), which are sets of rules that define which users or systems are granted access to specific objects. By requesting the download handler with a known page tag and the file parameter, an attacker can retrieve confidential attachments from pages that are restricted from being read.

Recommendations Update YesWiki to version 4.6.7 or later.