Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-63115 Details

Description

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship or `repost` belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/TryGhost/ActivityPub/commit/1526f540b983da97750b380868a210e6cdfb985e	[email protected]
https://github.com/TryGhost/ActivityPub/pull/1929	[email protected]
https://github.com/TryGhost/ActivityPub/releases/tag/v1.2.6	[email protected]
https://github.com/TryGhost/ActivityPub/security/advisories/GHSA-mm4q-93gr-5mwc	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-290	Authentication Bypass by Spoofing	[email protected]
CWE-345	Insufficient Verification of Data Authenticity	[email protected]
CWE-863	Incorrect Authorization	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Nov 2, 2026	CVE Modified	CISA-ADP
Oct 30, 2026	New CVE Received	[email protected]