{"id":"CVE-2026-63115","kind":"vulnerability","aliases":["CVE-2026-63115"],"related":[],"title":"Ghost ActivityPub server: remote servers can undo other accounts' follows","description":"ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship or `repost` belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.","summary":"ActivityPub is the multi-tenant federation server Ghost uses, built with Fedify. Before 1.2.6, a remote federated server could make the Undo handler remove another account's follow or repost without that account's involvement.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activitypub","fedify","ghost","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the installed ActivityPub version in your deployment; versions before `1.2.6` are affected\n- Confirm whether you run a self-hosted image of the ActivityPub server rather than Ghost's hosted service","fix":"- Move to version `1.2.6` or later (self-hosted image update and redeployment)","status":"open","published_at":"2026-10-30T22:16:57+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","triaged_at":"2026-10-30T22:27:20+00:00","updated_at":"2026-10-30T22:27:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T22:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Move to version `1.2.6` or later (self-hosted image update and redeployment)","reach":"internet","title":"Ghost ActivityPub server: remote servers can undo other accounts' follows","impact":"low","summary":"ActivityPub is the multi-tenant federation server Ghost uses, built with Fedify. Before 1.2.6, a remote federated server could make the Undo handler remove another account's follow or repost without that account's involvement.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ghost","activitypub","fedify","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Other accounts' follow or repost relationships get removed by remote servers","analyst_note":"","how_to_check":"- Check the installed ActivityPub version in your deployment; versions before `1.2.6` are affected\n- Confirm whether you run a self-hosted image of the ActivityPub server rather than Ghost's hosted service","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that self-host Ghost's ActivityPub server between 1.0.0 and 1.2.6 are exposed to remote servers sending forged Undo activities. Services using Ghost's hosted ActivityPub server were already updated, so they can skip it. No private data is exposed and content is not modified, but affected follows and reposts must be re-established.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4238,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-63115':13A,16A '1.0.0':74C '1.2.6':38B,76C,171C 'account':9A,50B,57B,104C,118C,121C 'act':90C 'activ':99C 'activitypub':2A,17B,24B,60C,66C,148C 'affect':135C 'allow':80C 'alreadi':151C 'anoth':49B,117C 'belong':115C 'built':34B,70C 'came':100C 'caus':86C 'content':130C 'could':43B 'cve':11A,14A 'data':126C 'differ':103C 'establish':141C 'exist':110C 'expos':128C 'feder':30B,41B,83C 'fedifi':18B,36B,72C 'fix':168C 'follow':10A,52B,93C,111C 'ghost':1A,19B,32B,69C,145C 'handler':47B,79C 'host':23B,147C,157C 'imag':162C 'involv':59B,123C 'issu':166C 'make':44B 'modifi':133C 'multi':28B,64C 'multi-ten':27B,63C 'packag':20B 'permit':106C 'privat':125C 'proxi':143C 're':140C 're-establish':139C 'redeploy':164C 'relationship':112C,136C 'remot':4A,40B,82C 'remov':48B,107C 'repost':54B,95C,114C 'requir':159C 'self':22B,156C 'self-host':21B,155C 'server':3A,5A,31B,42B,67C,84C,149C 'servic':88C,142C,158C 'tenant':29B,65C 'though':97C 'undo':7A,46B,78C 'updat':153C,161C 'use':33B 'version':170C 'without':55B,119C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Ghost's ActivityPub server between 1.0.0 and 1.2.6 are exposed to remote servers sending forged Undo activities. Services using Ghost's hosted ActivityPub server were already updated, so they can skip it. No private data is exposed and content is not modified, but affected follows and reposts must be re-established.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63115","severity":null,"published_at":"2026-10-30T22:16:57+00:00","modified_at":"2026-10-30T22:16:57+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","fetched_at":"2026-10-30T22:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}