CVE-2026-103476: YII2-Starter-Kit

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.

Affected products

• YII2-Starter-Kit YII2-Starter-Kit: up to and including 4.2.0

Published 2026-09-30. Last modified 2026-10-01.