9 matches found
CVE-2026-104467
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
EUVD-2026-91478
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467
Versions of YesWiki prior to 4.6.7 are susceptible to an authorization bypass vulnerability within the ApiService::isAuthorized() function. When public API mode is enabled, unauthenticated attackers can access administrative-only API routes. Specifically, attackers can target endpoints such as ap...
CVE-2026-104467: Missing Authorization
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
PT-2026-104277
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update config and api/archives to overwrite...
Nextcloud: ApiService#fetch serves content as text/html and inline Content-Disposition
https://github.com/nextcloud/text/blame/0bc7c3300607d57ee512dbf61497daec23961a12/lib/Service/ApiService.phpL109-L120 Impact XSS...