Authorization Bypass in YesWiki Affects Unauthenticated API Access
CVE-2026-104467

9.2CRITICAL

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104467?

The vulnerability in YesWiki prior to version 4.6.7 allows unauthorized users to bypass authentication when the public API mode is active. This flaw enables unauthenticated attackers to access and exploit admin-level API routes, including critical endpoints such as api/ci/update_config and api/archives. With this exploit, attackers could overwrite crucial settings and manipulate backup archives, leading to potential data loss or compromise.

Affected Version(s)

yeswiki 0 < 4.6.7

yeswiki 4.6.7

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sondt99
.