Is CVE-2026-103476 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103476?

CVE-2026-103476 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-103476

Description

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.