Live › vulnerability › CVE-2026-116208
Go to dashboardYesWiki before 4.7.0 trusts cross-actor ActivityPub activities during sync, so a malicious ActivityPub server can serve an outbox that deletes, overwrites or forges mirrored entries. An attacker can delete or overwrite content belonging to other actors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Sites running YesWiki from 4.6.2 before 4.7.0 that use its ActivityPub mirroring and run the admin-initiated sync against remote actors. The sources do not say whether the feature is on by default, so check whether ActivityPub is enabled. Sites on 4.7.0 or later, or without ActivityPub sync, can skip it.
No product ranges from the sources yet.
4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
This page as .md · .json · in your agent: get_signal("CVE-2026-116208")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.