Live › vulnerability › CVE-2026-63115
ActivityPub is the multi-tenant federation server Ghost uses, built with Fedify. Before 1.2.6, a remote federated server could make the Undo handler remove another account's follow or repost without that account's involvement.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Teams that self-host Ghost's ActivityPub server between 1.0.0 and 1.2.6 are exposed to remote servers sending forged Undo activities. Services using Ghost's hosted ActivityPub server were already updated, so they can skip it. No private data is exposed and content is not modified, but affected follows and reposts must be re-established.
No product ranges from the sources yet.
1.2.6 are affected1.2.6 or later (self-hosted image update and redeployment)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing follow relationship or repost belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-63115")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.