Medium severity · published Sep 30, 2026
CVE-2026-103476
yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YI
yii2-starter-kit · yii2-starter-kit
through 4.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103476
issue-tracking
https://github.com/yii-starter-kit/yii2-starter-kit/issues/797
product
https://github.com/yii-starter-kit/yii2-starter-kit
technical-description
https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/frontend/controllers/ArticleController.php#L69
third-party-advisory
https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unauthorized-file-download-via-attachment-download
More from yii2-starter-kit
9.1
CVE-2026-103475
yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
8.8
CVE-2026-103474
yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE