{"id":"CVE-2026-116208","kind":"vulnerability","aliases":["CVE-2026-116208"],"related":[],"title":"YesWiki: missing authorization lets rogue ActivityPub servers alter other actors' entries","description":"YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.","summary":"YesWiki before 4.7.0 trusts cross-actor ActivityPub activities during sync, so a malicious ActivityPub server can serve an outbox that deletes, overwrites or forges mirrored entries. An attacker can delete or overwrite content belonging to other actors.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activitypub","package","php","self-hosted","yeswiki"],"not_affected_if":["activitypub-sync-unused","version-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version; the sources say versions 4.6.2 up to but not including 4.7.0 are affected.\n- Look for ActivityPub sync features enabled and an admin running the sync against remote servers.","fix":"- Upgrade YesWiki to `4.7.0` or later.","status":"open","published_at":"2026-10-25T14:17:02+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:27+00:00","updated_at":"2026-10-25T14:42:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.","reach":"internet","title":"YesWiki: missing authorization lets rogue ActivityPub servers alter other actors' entries","impact":"medium","summary":"YesWiki before 4.7.0 trusts cross-actor ActivityPub activities during sync, so a malicious ActivityPub server can serve an outbox that deletes, overwrites or forges mirrored entries. An attacker can delete or overwrite content belonging to other actors.","category":"package","nicknames":[],"who_cares":["yeswiki","activitypub","self-hosted","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Other actors' mirrored entries get deleted, overwritten or forged","analyst_note":"Confirm whether ActivityPub sync is on by default and whether an admin must trigger the sync; check the NVD record and the YesWiki 4.7.0 release notes.","how_to_check":"- Check the installed YesWiki version; the sources say versions 4.6.2 up to but not including 4.7.0 are affected.\n- Look for ActivityPub sync features enabled and an admin running the sync against remote servers.","needs_analyst":true,"not_affected_if":["version-4.7.0-or-later","activitypub-sync-unused"],"who_is_affected":"Sites running YesWiki from 4.6.2 before 4.7.0 that use its ActivityPub mirroring and run the admin-initiated sync against remote actors. The sources do not say whether the feature is on by default, so check whether ActivityPub is enabled. Sites on 4.7.0 or later, or without ActivityPub sync, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3372,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116208':14A,17A '-2026':13A,16A '4.6.2':65C '4.7.0':27B,67C 'activ':33B,100C 'activitypub':6A,18B,32B,39B,79C 'activitypubservic':74C 'actor':10A,31B,62B,83C,95C 'admin':103C 'admin-initi':102C 'alter':8A 'attack':53B,86C 'author':3A,71C 'belong':59B 'contain':68C 'content':58B 'creat':99C 'cross':30B,94C 'cross-actor':29B,93C 'cve':12A,15A 'delet':46B,55B,96C,107C,113C 'entri':11A,51B,85C,114C 'forg':49B,109C 'host':23B 'initi':104C 'let':4A,77C 'malici':38B,78C 'manipul':81C 'mass':112C 'mass-delet':111C 'mirror':50B,84C 'miss':2A,70C 'outbox':44B,91C 'overwrit':47B,57B,108C 'packag':19B 'php':20B 'poison':90C 'rogu':5A 'self':22B 'self-host':21B 'serv':42B,88C 'server':7A,40B,80C 'sync':35B,105C 'syncactorpost':75C 'trust':28B 'updat':97C 'vulner':72C 'yeswiki':1A,24B,25B,63C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki from 4.6.2 before 4.7.0 that use its ActivityPub mirroring and run the admin-initiated sync against remote actors. The sources do not say whether the feature is on by default, so check whether ActivityPub is enabled. Sites on 4.7.0 or later, or without ActivityPub sync, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116208","severity":null,"published_at":"2026-10-25T14:17:02+00:00","modified_at":"2026-10-25T14:17:02+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}