CVE-2026-116208 Details
Description
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
A missing authorization vulnerability has been identified in YesWiki versions 4.6.2 prior to 4.7.0, specifically within the ActivityPub synchronization function for actor posts. This vulnerability allows malicious ActivityPub servers to manipulate mirrored entries of other actors. By injecting harmful outbox activities during an admin-initiated synchronization, attackers can delete, overwrite, forge, or mass-delete entries. The issue arises because the sync function lacks necessary authorization checks, leaving it open to exploitation.
Update YesWiki to version 4.7.0 or later, where this vulnerability has been fixed. As an interim measure, administrators can avoid syncing with untrusted ActivityPub actors.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-4.6.2-before-4.7.0-missing-authorization-in-activitypub-syncactorposts | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | >= 4.6.2, < 4.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |