CVE-2026-103476CWE-639

CVE-2026-103476

Medium · published September 30, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00290 · 20.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-30T22:18Z
References (4)
https://github.com/yii-starter-kit/yii2-starter-kit · [email protected]https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/frontend/controllers/ArticleController.php#L69 · [email protected]https://github.com/yii-starter-kit/yii2-starter-kit/issues/797 · [email protected]https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unauthorized-file-download-via-attachment-download · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 17:22Z
    yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
    cvelistv5