CyberRota Analysis
AI-GeneratedYesWiki versions prior to 4.6.7 are vulnerable due to a missing authorization flaw in the attachment download handler, enabling unauthenticated attackers to bypass access control lists (ACLs) for page reads. This vulnerability allows attackers to access and download confidential attachments from pages that should be restricted. Organizations using affected versions of YesWiki should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.