Unauthorized File Download in Yii2 Starter Kit Affects Unpublished Articles
CVE-2026-103476

6.9MEDIUM

Key Information:

Vendor

Yii2-starter-kit

Status
Yii2-starter-kit
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103476?

The yii2-starter-kit application, through version 4.2.0, fails to secure the attachment-download endpoint, enabling unauthorized users to access unpublished article files. This vulnerability allows attackers to exploit the lack of proper validation by enumerating attachment identifiers, thus obtaining sensitive content from draft articles without requiring any authentication or authorization.

Affected Version(s)

yii2-starter-kit 0 <= 4.2.0

References

https://github.com/yii-starter-kit/yii2-starter-kit/issue...
issue-tracking
https://github.com/yii-starter-kit/yii2-starter-kit
product
https://github.com/yii-starter-kit/yii2-starter-kit/blob/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vikash Gupta
.