CyberRota Analysis
AI-GeneratedYesWiki versions prior to 4.6.7 are vulnerable to an authorization bypass in the ApiService::isAuthorized() function, enabling unauthenticated attackers to access admin-only API routes when public API mode is active. This flaw allows attackers to manipulate configurations and manage backup archives, posing a significant risk to system integrity and data security. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.