Description

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-02T12:17:20.197Z",
  "pubdate": "2026-10-02T12:17:20.197Z",
  "executiveSummary": "YesWiki versions prior to 4.6.7 are susceptible to a critical authorization flaw within the attachment download handler mechanism. This vulnerability constitutes a broken access control issue, specifically a failure to enforce page-level read Access Control Lists (ACLs) during the retrieval process of stored files.\nThe vulnerability allows unauthenticated, remote attackers to bypass security restrictions intended to protect private or restricted content. By interacting with the download handler, an adversary can retrieve sensitive attachments from restricted pages simply by identifying the corresponding page tag and the filename of the target object. This results in the unauthorized disclosure of potentially confidential or proprietary data stored within the wiki environment.\nThe impact is significant, as the exposure of sensitive files does not require an active session or elevated privileges. Because the flaw exists in the core handling of file downloads, it bypasses the standard authentication and authorization checks implemented elsewhere in the application. Organizations utilizing YesWiki are at risk of data leakage if they rely on ACLs to secure private attachments. Remediation requires an immediate update to version 4.6.7 or later to ensure that the download handler correctly validates the requester's permissions against the target page's security policy.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization checks within the YesWiki file retrieval component. Specifically, the application's attachment download handler fails to verify the current user's session state and authorization level against the ACL defined for the parent page associated with the requested file.\nIn YesWiki, attachments are associated with specific pages, and the visibility of these files is intended to be governed by the access restrictions of the parent page. However, the download handler operates under an insecure assumption that requests for files do not require re-validation of the caller's authorization. Consequently, the application treats the attachment retrieval request as an independent action disconnected from the page-level security context.\nThe exploitation flow is straightforward and does not require specialized tools. An attacker needs only two pieces of information: the unique tag associated with a specific YesWiki page and the filename of the target attachment. By crafting a direct HTTP request to the download handler, an attacker can bypass the UI-level restrictions that would normally prevent unauthorized users from viewing or interacting with private content.\nStep-by-step exploitation process:\n1. Information Gathering: The attacker identifies the page tag (e.g., via directory traversal, search engine indexing, or public metadata) that contains restricted attachments.\n2. Targeting: The attacker identifies the name of the file intended for retrieval. If the file naming convention is predictable or discoverable via other means, the attacker can target specific documents.\n3. Request Crafting: The attacker submits a GET request to the YesWiki download handler endpoint. This request includes the page tag and the file parameter pointing to the sensitive attachment.\n4. ACL Bypass: The server-side download handler processes the request but fails to trigger the function responsible for checking the page's ACL. As a result, the backend application retrieves the file from the filesystem or storage layer and serves it directly to the requester.\n5. Exfiltration: The file is delivered as an HTTP response to the attacker, effectively circumventing the intended confidentiality controls.\nThis vulnerability is classified as a Missing Authorization flaw, enabling unauthorized read access to potentially sensitive infrastructure documentation, user data, or project assets. The exposure persists regardless of the security settings configured for the pages themselves, as the flaw resides in the handling logic of the files attached to those pages."
}