YesWiki versions before 4.6.7 contain an authorization bypass flaw in ApiService::isAuthorized() that lets an unauthenticated user execute admin‑only API endpoints when public API mode is active. By sending requests to routes such as api/ci/update_config or api/archives, an attacker can overwrite site configuration and list, download, or delete backup archives. The vulnerability is a classic example of improper authorization (CWE‑862).

The vulnerability affects the YesWiki content management system, specifically versions prior to 4.6.7, when the site is configured to allow public API access. Users should verify that their installation is running 4.6.7 or later or that the public API mode is disabled.

The CVSS score of 9.2 indicates a critical severity with full remote impact; the vulnerability is exploitable over the network via the public API layer. While EPSS data is not available, the lack of a KEV listing does not diminish the risk, as attackers can directly target exposed endpoints. The likely attack vector is a remote, unauthenticated request to the API endpoint, requiring no user credentials and offering privileged access to configuration and backup data.