Description

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-10-02T12:17:19.373Z",
  "pubdate": "2026-10-02T12:17:19.373Z",
  "executiveSummary": "YesWiki versions prior to 4.6.7 are susceptible to an authorization bypass vulnerability located within the ApiService::isAuthorized() method. This vulnerability stems from improper access control validation when the application is configured in public API mode.\nThe flaw allows unauthenticated remote attackers to bypass established security constraints and invoke administrative API routes that should be restricted to authenticated, privileged users.\nThe potential impact is severe, as it enables unauthorized modification of application configuration settings and arbitrary management of backup archives. Attackers can leverage this vulnerability to exfiltrate sensitive data, delete system backups, or manipulate core application functionality. The vulnerability is exploitable over a network without requiring prior authentication, significantly increasing the risk profile for instances where the public API feature is enabled. Organizations utilizing YesWiki must prioritize patching to version 4.6.7 or higher to remediate the broken access control mechanism.",
  "technicalDetails": "The vulnerability resides in the ApiService::isAuthorized() function, which serves as the centralized gatekeeper for API request validation within the YesWiki architecture. Analysis indicates that the logic governing access control fails to adequately verify the session or privilege context when the public API mode is active.\nRoot Cause: The primary deficiency is the failure of the ApiService::isAuthorized() method to perform a strict check against the requesting user's identity before routing requests to administrative controllers. When public API mode is toggled on, the application incorrectly defaults to a permissive state, assuming that incoming traffic is intended for public-facing endpoints. This design oversight allows an attacker to manipulate the request path to target administrative methods.\nExploitation Method: Attackers can interact with restricted endpoints such as api/ci/update_config and api/archives without valid session tokens or administrative credentials. By crafting malicious HTTP requests targeting these specific routes, an attacker bypasses the intended security enforcement.\nAttack Flow: 1. The attacker identifies an instance of YesWiki with public API mode enabled. 2. The attacker crafts a request to an administrative endpoint (e.g., api/ci/update_config). 3. The ApiService::isAuthorized() function evaluates the request. Due to the flaw, it returns a boolean 'true' result despite the absence of an authenticated user session. 4. The underlying framework routes the request to the sensitive controller, which executes the requested action with administrative privileges.\nPayload Behavior and Impact: Upon accessing api/ci/update_config, an attacker can modify the application's core configuration files. This could lead to a total compromise of the application's operational integrity, including credential theft or server-side request forgery (SSRF). By accessing api/archives, the attacker can enumerate, download, or delete existing system backups. Deleting backups is a destructive action that prevents system restoration, while downloading them provides the attacker with sensitive application data, database dumps, and historical content, leading to large-scale information disclosure."
}