Live › vulnerability › CVE-2026-116825
Go to dashboardYesWiki's HTTP signature check on its ActivityPub inbox never validates the Date header or tracks seen signatures, so a signed request can be captured and sent again. An attacker who replays a signed Delete, Update, Follow or Undo activity can repeat those actions on the wiki.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams running YesWiki from 4.6.2 up to but not including 4.7.0 that expose the forms actor inbox endpoint to federated ActivityPub traffic. The sources do not say whether the endpoint is on by default, so a team on an affected version should assume it is reachable until checked. Sites on versions 4.7.0 or later are not affected.
No product ranges from the sources yet.
/api/forms/{formId}/actor/inbox is reachable from the internet.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116825")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.