---
id: "CVE-2026-63115"
kind: "vulnerability"
aliases: ["CVE-2026-63115"]
title: "Ghost ActivityPub server: remote servers can undo other accounts' follows"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["activitypub", "fedify", "ghost", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-30T22:16:57+00:00"
first_seen_at: "2026-10-30T22:25:56+00:00"
updated_at: "2026-10-30T22:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63115", "first_seen_at": "2026-10-30T22:25:56+00:00"}]
---

# Ghost ActivityPub server: remote servers can undo other accounts' follows

ActivityPub is the multi-tenant federation server Ghost uses, built with Fedify. Before 1.2.6, a remote federated server could make the Undo handler remove another account's follow or repost without that account's involvement.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ActivityPub version in your deployment; versions before `1.2.6` are affected
- Confirm whether you run a self-hosted image of the ActivityPub server rather than Ghost's hosted service

## Fix

- Move to version `1.2.6` or later (self-hosted image update and redeployment)

## Timeline

- 2026-10-30T22:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63115

## From the sources

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship or `repost` belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_