External risk intelligence

YesWiki Authorization Bypass in Public API Mode

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-104467

YesWiki is a web-based platform, and the vulnerability specifically affects API routes. While the issue requires 'public API mode' to be enabled, this is a configuration choice for a web application commonly deployed on the public internet to serve content or interact with external users, making the exposed API endpoints likely to be reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in YesWiki, a web-based platform, that could allow unauthorized access to administrative functions and sensitive backup data. This issue arises from an authorization bypass flaw within the API service when a specific configuration mode is enabled, potentially exposing system control and archived information to external actors. The main concern is confirming relevance and exposure.

Unauthenticated users can bypass authorization.
Protects critical administrative functions and data.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending unauthenticated requests to specific API endpoints if the application has public API mode enabled. This bypasses authorization checks, allowing the attacker to potentially alter system configurations or access sensitive backup data.

Requires public API mode to be enabled.
Triggered by unauthenticated API requests.
Allows configuration changes and archive access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authorization controls in YesWiki when public API mode is enabled. This could lead to unauthorized access to and modification of system configurations and backup archives.

System configuration and backup archives at risk.
Unauthenticated access to API routes.
Unauthorized modification and data disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely falls to the platform or application owners responsible for the YesWiki deployment. The first practical step is to identify all instances of YesWiki, confirm if "public API mode" is enabled, and assess their exposure and criticality. This triage will inform prioritized remediation planning, which may involve vendor coordination if a patch is available or configuration changes to disable public API mode as a mitigating control.

Confirm YesWiki instances and public API mode.
Identify accountable owner and assess business criticality.
Plan remediation based on risk and vendor advisories.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YesWiki and what is it used for?

YesWiki is a flexible, web-based platform designed for building collaborative websites and wikis. It allows users to organize content, manage information, and interact with data through various plugins and themes. Because it is web-based, it is often deployed to host public content, serving as a dynamic environment where multiple users contribute to shared projects or documentation.

What does the CVE-2026-104467 authorization bypass mean?

This vulnerability, classified as CWE-862 (Missing Authorization), means the software fails to verify if a user has permission to perform sensitive tasks. In this specific case, the flaw in the ApiService allows anyone to execute administrative commands—such as changing system settings or accessing backups—without needing to log in first, provided the application is in a certain state.

How is this vulnerability triggered in YesWiki?

The flaw is triggered when an attacker sends specific network requests to admin-only API endpoints. It is important to note that this does not affect all installations; the vulnerability is only reachable when the 'public API mode' configuration is enabled. If this mode is disabled, the system does not allow these unauthenticated requests to reach the vulnerable code paths.

Is my YesWiki instance at risk?

If you run YesWiki, you should consider your instance at risk if it is accessible from the internet and has 'public API mode' enabled. According to Halo Surface Signal, because YesWiki is typically deployed as a web-facing platform, these API endpoints are often reachable by outside actors, making the risk more significant for any internet-facing installation.

What are the first steps to secure my installation?

Start by identifying all YesWiki instances in your environment. For each instance, verify whether the 'public API mode' is currently enabled. If it is active, evaluate if your business needs this feature; if not, disable it immediately to eliminate the attack path. If the feature is required, monitor official vendor channels for available patches and plan to update to version 4.6.7 or later as soon as possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.