CVE-2026-116825: YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must capture a previously valid signed HTTP request sent to an ActivityPub inbox endpoint in the form /api/forms/{formId}/actor/inbox. They can then replay that request without needing privileges or user interaction.
Which deployments are affected?
YesWiki versions from 4.6.2 before 4.7.0 are affected. The vulnerable behavior is in HTTP signature verification for the ActivityPub inbox endpoint.
What actions can be repeated through a replay?
A captured request can be replayed to re-execute Delete, Update, Follow, or Undo actions. The request remains usable because the signature verification does not validate its Date header or record previously seen signatures.