CVE-2026-116208: YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Which deployments are in the reported affected version range?
The reported affected range is YesWiki 4.6.2 before 4.7.0. Upgrading to 4.7.0 or later moves the deployment outside the stated vulnerable range.
What must occur for exploitation?
An attacker needs to operate or control a malicious ActivityPub server that serves a poisoned outbox. An administrator must initiate synchronization with that server; the malicious activities can then target mirrored entries belonging to other actors.