The vulnerability arises from a missing authorization check in YesWiki's attachment download handler. Unauthenticated attackers can craft requests to this handler by specifying a known page tag and file parameter, thereby bypassing the page read Access Control Lists (ACLs) and retrieving confidential attachments. This flaw results in unauthorized disclosure of sensitive files that should be protected by read permissions.

YesWiki platform versions prior to 4.6.7 are affected. The vulnerability applies to deployments of YesWiki that use the default attachment download endpoint without supplemental access controls.

The CVSS score of 8.7 indicates a high severity risk, and the vulnerability is exploitable over the network without authentication, meaning attackers can trigger it from any remote host. EPSS is not available, and it is not listed in the CISA KEV catalog, but the absence of EPSS data does not diminish the high impact of potential data exposure. Attackers can directly request the download endpoint with the appropriate parameters and obtain private attachment data, thereby compromising confidentiality. The lack of an authorization check is the root cause.