CVE-2026-104467: YesWiki Authorization Bypass Vulnerability

CVE-2026-104467 Overview

CVE-2026-104467 is an authorization bypass vulnerability in YesWiki versions prior to 4.6.7. The flaw resides in the ApiService::isAuthorized() method and permits unauthenticated attackers to invoke admin-only API routes when public API mode is enabled. Successful exploitation lets attackers reach sensitive endpoints such as api/ci/update_config and api/archives. These endpoints can overwrite the YesWiki configuration and list, download, or delete backup archives. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact
Remote, unauthenticated attackers can tamper with YesWiki configuration and exfiltrate or destroy backup archives, undermining confidentiality, integrity, and availability of the wiki instance.

Affected Products

YesWiki versions prior to 4.6.7
YesWiki instances with public API mode enabled
YesWiki deployments exposing api/ci/update_config and api/archives endpoints

Discovery Timeline

2026-10-02 - CVE-2026-104467 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104467

Vulnerability Analysis

YesWiki exposes a REST API gated by the ApiService::isAuthorized() authorization check. When public API mode is enabled, this check fails to differentiate between routes intended for public read access and routes reserved for administrators. The result is that unauthenticated HTTP requests can reach admin-only endpoints.

Two endpoints materially raise the impact. The api/ci/update_config route accepts configuration overwrites, allowing an attacker to modify wiki settings. The api/archives route exposes backup management, enabling listing, downloading, or deletion of archive files. Configuration overwrite can be chained into further compromise, while archive download leaks sensitive backup data such as database dumps.

Root Cause

The root cause is missing authorization enforcement inside ApiService::isAuthorized() [CWE-862]. The method treats public API mode as an authorization grant for all routes rather than scoping it to endpoints explicitly marked public. Administrator-only routes inherit this permissive decision and skip the required privilege check.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests directly to the vulnerable API endpoints on a YesWiki instance with public API mode enabled. Because the authorization decision is made before the handler runs, no credentials or session tokens are required. Full technical details are available in the GitHub Security Advisory GHSA-v527-6r4j-j2w2 and the VulnCheck Advisory on YesWiki API.

// No verified exploit code is published for CVE-2026-104467.
// Refer to the GitHub Security Advisory and VulnCheck advisory for
// endpoint-level technical details.

Detection Methods for CVE-2026-104467

Indicators of Compromise

Unauthenticated HTTP requests to api/ci/update_config in web server access logs
Requests to api/archives from unexpected source IP addresses, especially GET and DELETE methods
Unexplained modifications to the YesWiki configuration files or wiki parameters
Missing, altered, or newly downloaded backup archives on the server

Detection Strategies

Alert on any request to /api/ci/update_config or /api/archives that lacks a prior authenticated session cookie
Correlate configuration file modification events with inbound API traffic on the same host
Baseline normal API callers and flag new user agents or IPs invoking admin routes

Monitoring Recommendations

Enable verbose access logging on the YesWiki web server and forward logs to a central analytics platform
Monitor file integrity on YesWiki configuration directories and the backup archive location
Track outbound bandwidth from the YesWiki host for signs of backup archive exfiltration

How to Mitigate CVE-2026-104467

Immediate Actions Required

Upgrade YesWiki to version 4.6.7 or later as the primary remediation
Disable public API mode on instances that do not require anonymous API access
Review YesWiki configuration and backup archives for unauthorized modifications or downloads
Rotate any credentials or secrets that may have been exposed through accessible backup archives

Patch Information

The vulnerability is fixed in YesWiki 4.6.7. Upgrade details and the authorization logic fix are documented in the GitHub Security Advisory GHSA-v527-6r4j-j2w2. Administrators who cannot upgrade immediately should treat public API mode as unsafe until the patch is applied.

Workarounds

Turn off public API mode in the YesWiki configuration until the upgrade is completed
Restrict access to /api/ci/update_config and /api/archives at the web server or reverse proxy layer
Place the YesWiki administrative interface and API behind network-level access controls or a VPN

bash

# Example nginx snippet to block admin-only API routes at the proxy
location ~ ^/api/(ci/update_config|archives) {
    deny all;
    return 403;
}