Is CVE-2026-103476 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103476 being exploited in the wild.

How severe is CVE-2026-103476?

Medium severity, with a CVSS score of 5.3, published 30 September 2026.

Which products and versions are affected?

Yii-Starter-Kit Yii2-Starter-Kit through 4.2.0.

Is there a fix for CVE-2026-103476?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103476 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103476?

Check whether you run Yii-Starter-Kit Yii2-Starter-Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103476: yii2-starter-kit missing article publication validation in attachment download

CVE-2026-103476 · Severity: medium · CVSS 5.3 · Published 2026-09-30

yii2-starter-kit is a Yii2 web application template that allows users to create and publish articles. An attacker can bypass authentication to download files attached to draft articles by directly accessing the attachment-download endpoint and guessing sequential attachment identifiers, exposing unpublished content without permission.

Technologies: Yii-Starter-Kit Yii2-Starter-Kit. Vendors: Yii-Starter-Kit.

Quick answers

Is CVE-2026-103476 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103476 being exploited in the wild.
How severe is CVE-2026-103476?: Medium severity, with a CVSS score of 5.3, published 30 September 2026.
Which products and versions are affected?: Yii-Starter-Kit Yii2-Starter-Kit through 4.2.0.
Is there a fix for CVE-2026-103476?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103476 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103476?: Check whether you run Yii-Starter-Kit Yii2-Starter-Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The attachment-download endpoint in yii2-starter-kit through version 4.2.0 fails to validate the publication status of articles before serving attached files. An unauthenticated attacker can enumerate sequential attachment IDs to retrieve files associated with draft or unpublished articles, bypassing both authentication and authorization controls on the article content itself.

Affected products

yii-starter-kit yii2-starter-kit through 4.2.0

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.