CVE-2026-104467

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description An authorization bypass exists in the isAuthorized() function of the ApiService when public API mode is enabled. This allows unauthenticated attackers to access administrative API routes. Specifically, attackers can interact with the 'api/ci/update config' and 'api/archives' endpoints to overwrite system configurations or list, download, and delete backup archives.

Recommendations Update YesWiki to version 4.6.7 or later. As a temporary mitigation, disable the public API mode to prevent unauthorized access to the isAuthorized() function.