CVE-2026-104445
Deferred Deferred - Pending Action

Authentication Bypass in YesWiki via ActivityPub Inbox

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104445
EUVD
EUVD-2026-91456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.7 has an authentication bypass flaw in the ActivityPub inbox. It fails to verify that the signer of an HTTP request matches the activity actor. Attackers with any ActivityPub keypair can send signed Delete or Update activities targeting a mirrored entry's sourceUrl to delete or overwrite federated entries belonging to other users without authentication.

Detection Guidance

To detect this vulnerability, monitor HTTP ActivityPub inbox requests for unsigned or improperly signed Delete or Update activities referencing mirrored entries. Check YesWiki logs for unauthorized modifications to federated entries. Use network traffic analysis tools like Wireshark to inspect HTTP signatures for mismatches between the signer and activity actor.

Impact Analysis

If you use YesWiki with ActivityPub integration before 4.6.7, an attacker could delete or modify your federated content by sending crafted requests. This could disrupt your wiki's functionality, spread misinformation, or cause data loss if your entries are overwritten.

Compliance Impact

This vulnerability could lead to unauthorized modification or deletion of data, violating integrity and availability requirements in GDPR and HIPAA. If personal or sensitive data is altered or lost, it may result in non-compliance with these regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later to address the authentication bypass in ActivityPub inbox handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart