{"id":"CVE-2026-116825","kind":"vulnerability","aliases":["CVE-2026-116825"],"related":[],"title":"YesWiki: captured ActivityPub requests can be replayed to repeat actions","description":"YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.","summary":"YesWiki's HTTP signature check on its ActivityPub inbox never validates the Date header or tracks seen signatures, so a signed request can be captured and sent again. An attacker who replays a signed Delete, Update, Follow or Undo activity can repeat those actions on the wiki.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activitypub","package","self-hosted","yeswiki"],"not_affected_if":["version-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version; the sources say versions from 4.6.2 up to but not including 4.7.0 are affected.\n- Confirm whether the ActivityPub actor inbox at `/api/forms/{formId}/actor/inbox` is reachable from the internet.","fix":"- Upgrade YesWiki to `4.7.0` or later.","status":"open","published_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:17+00:00","updated_at":"2026-10-27T00:26:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.","reach":"internet","title":"YesWiki: captured ActivityPub requests can be replayed to repeat actions","impact":"medium","summary":"YesWiki's HTTP signature check on its ActivityPub inbox never validates the Date header or tracks seen signatures, so a signed request can be captured and sent again. An attacker who replays a signed Delete, Update, Follow or Undo activity can repeat those actions on the wiki.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","activitypub"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker repeats captured signed federation actions, such as deletes or follows.","analyst_note":"Confirm from the NVD entry or the YesWiki 4.7.0 release notes whether the inbox endpoint is enabled by default and what data a replayed Delete or Update can change.","how_to_check":"- Check the installed YesWiki version; the sources say versions from 4.6.2 up to but not including 4.7.0 are affected.\n- Confirm whether the ActivityPub actor inbox at `/api/forms/{formId}/actor/inbox` is reachable from the internet.","needs_analyst":true,"not_affected_if":["version-4.7.0-or-later"],"who_is_affected":"Teams running YesWiki from 4.6.2 up to but not including 4.7.0 that expose the forms actor inbox endpoint to federated ActivityPub traffic. The sources do not say whether the endpoint is on by default, so a team on an affected version should assume it is reachable until checked. Sites on versions 4.7.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3352,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116825':13A,16A '-2026':12A,15A '/actor/inbox':101C '/api/forms':99C '4.6.2':72C '4.7.0':74C 'action':10A,66B,116C 'activ':62B 'activitypub':3A,17B,30B 'attack':52B,91C 'captur':2A,47B,93C 'check':27B 'cve':11A,14A 'date':35B,85C 'delet':57B,111C 'endpoint':102C 'execut':110C 'follow':59B,113C 'formid':100C 'header':36B,86C 'host':21B 'http':25B 'httpsignatureservic':79C 'inbox':31B 'lack':75C 'later':106C 'never':32B,82C 'packag':18B 'protect':77C 're':109C 're-execut':108C 'repeat':9A,64B 'replay':7A,54B,76C,104C 'request':4A,44B,96C 'seen':39B,89C 'self':20B 'self-host':19B 'sent':49B 'sign':43B,56B,95C 'signatur':26B,40B,90C 'track':38B,88C 'undo':61B,115C 'updat':58B,112C 'valid':33B,83C 'verifysignatur':80C 'wiki':69B 'yeswiki':1A,22B,23B,70C","nicknames":[],"mitigations":[],"who_affected":"Teams running YesWiki from 4.6.2 up to but not including 4.7.0 that expose the forms actor inbox endpoint to federated ActivityPub traffic. The sources do not say whether the endpoint is on by default, so a team on an affected version should assume it is reachable until checked. Sites on versions 4.7.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116825","severity":null,"published_at":"2026-10-27T00:17:17+00:00","modified_at":"2026-10-27T00:17:18+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}