CVE-2026-116208
Deferred Deferred - Pending Action

ActivityPub Authorization Flaw in YesWiki

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116208
EUVD
EUVD-2026-109466

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YesWiki yeswiki 4.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects YesWiki versions 4.6.2 to 4.6.7 (before 4.7.0). It is a missing authorization flaw in the ActivityPubService::syncActorPosts function that allows malicious ActivityPub servers to manipulate entries belonging to other federated actors during admin-initiated synchronization. Attackers can inject poisoned outbox activities containing cross-actor Delete, Update, or Create operations to delete, overwrite, forge, or mass-delete wiki entries without proper authorization.

Detection Guidance

Check YesWiki versions between 4.6.2 and 4.7.0 for the vulnerable ActivityPubService::syncActorPosts function. Monitor logs for unexpected entry deletions, modifications, or mass deletions during ActivityPub sync operations. Review network traffic for untrusted ActivityPub server interactions.

Impact Analysis

If you use YesWiki versions 4.6.2 to 4.6.7, an attacker could delete, modify, or forge your wiki entries during synchronization with a malicious ActivityPub server. This could lead to data loss, misinformation, or unauthorized changes to your wiki content. The attack requires an administrator to initiate the sync but does not require the attacker to have any privileges on your instance.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized modification or deletion of sensitive data stored in wiki entries. GDPR requires data integrity and protection, while HIPAA mandates safeguards for protected health information. Unauthorized changes or deletions could violate these regulations, leading to legal and reputational risks.

Mitigation Strategies

Upgrade YesWiki to version 4.7.0 or later. Avoid syncing with untrusted ActivityPub servers. Apply authorization checks to the sync handler similar to the inbox handler. Verify ownership during garbage collection to prevent unauthorized entry manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart