CVE-2026-103476 in yii2-starter-kit
Summary
by MITRE • 09/30/2026
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in yii2-starter-kit versions through 4.2.0 represents a critical failure in access control mechanisms, specifically within the attachment-download endpoint. This flaw stems from an insufficient validation of article publication status when processing requests for file downloads. In typical content management systems and starter kits like this one, articles are often maintained in various states such as draft, pending review, or published. The security model relies on these statuses to enforce authorization policies that restrict access to sensitive information until the content is officially released. However, the implementation fails to cross-reference the publication status of an article with the permissions granted to the requesting user during the file retrieval process.
This technical flaw allows unauthenticated attackers to bypass authentication and authorization checks entirely by exploiting sequential attachment identifiers. Since many systems generate unique identifiers for attachments using predictable patterns such as auto-incrementing integers, adversaries can perform enumeration attacks. By systematically iterating through these sequential IDs, an attacker can request downloads of files associated with articles that are still in draft status or otherwise unpublished. The server processes these requests without verifying whether the user has legitimate access rights to view the content linked to those attachments, effectively treating all download requests as valid regardless of the underlying article's visibility settings.
The operational impact of this vulnerability is significant, particularly for applications handling sensitive data within their early development stages. Draft articles often contain proprietary information, personal identifiable information, or other confidential material that administrators intend to keep private until final review and approval are complete. The ability to download files from these unpublished articles exposes such data to the public internet without any barrier. This constitutes a severe confidentiality breach, potentially leading to intellectual property theft, privacy violations under regulations like GDPR or CCPA, and reputational damage for organizations relying on this framework for their web applications.
From an industry standards perspective, this vulnerability aligns with CWE-284 Improper Access Control, as the application fails to restrict access to resources based on user privileges. It also relates closely to CWE-601 URL Redirection to Untrusted Site (Open Redirect) in a broader sense of trust boundary violation, but more accurately fits CWE-359 Exposure of Private Information Under an Incorrect Label if one considers the draft status as a label that was ignored. In terms of MITRE ATT&CK techniques, this behavior is consistent with T1087 Account Discovery and T1046 Network Service Scanning when combined with enumeration strategies to map out available resources on the server. The lack of proper validation allows for unauthorized data exfiltration which falls under Data Exfiltration tactics in advanced persistent threat scenarios.
To mitigate this vulnerability, developers must implement strict access control checks within the attachment-download endpoint logic before serving any files. This involves verifying that the article associated with the requested attachment is in a published or publicly accessible state and ensuring that only authenticated users with appropriate roles can retrieve attachments from non-public articles. Implementing randomization for identifier generation rather than relying on sequential integers can also reduce the effectiveness of enumeration attacks, although it should not be considered a primary defense mechanism. Additionally, applying principle of least privilege ensures that even if an attacker discovers valid identifiers, they cannot access resources unless explicitly authorized by the application's security policy. Regular code audits and static analysis tools configured to detect improper access control patterns are recommended to prevent similar issues in future updates or custom implementations based on this starter kit.