vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-116208

YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

HIGH
8.1
CVSS Score
Published: October 25, 2026 at 01:20 PM UTC
Updated: October 25, 2026 at 02:17 PM UTC
1 product affected across 1 vendorYesWiki

Using yeswiki by YesWiki?

Get instant alerts when new vulnerabilities affect yeswiki - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.1
Exploit prediction
EPSS 0.2%

Description

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

YesWiki· Yeswiki
90%
4.6.2
Vendor states this is fixed in 4.7.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisory
Source: cverecord
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/yeswiki-4.6.2-before-4.7.0-missing-authorization-in-activitypub-syncactorposts

CVSS

8.1HIGHVulnCheck
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card