CVE Alert: CVE-2026-116208 – YesWiki

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors’ mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.

**Risk verdict:** This presents a high-impact integrity and availability risk; urgency against active exploitation is uncertain because KEV, SSVC and EPSS data were not provided.

**Why this matters:** Successful abuse could corrupt or remove community content, including in bulk, undermining trust in the site and disrupting its use. Likely attacker goals include defacing or falsifying information, causing service disruption, or damaging an organisation’s reputation.

**Most likely attack path:** The attack is network-reachable, requires no attacker privileges and has low complexity, but depends on the victim environment syncing ActivityPub content from a malicious or compromised peer. User interaction is indicated, so confirm whether an administrator must initiate or enable sync; scope is unchanged, suggesting impact is confined to the affected application rather than directly extending to other systems.

**Who is most exposed:** Organisations running YesWiki with ActivityPub federation enabled and synchronising content from external actors are most exposed; sites with federation disabled have less immediate exposure.

Review ActivityPub sync logs for unusual or unexpectedly large batches of changes.

Audit deletion and edit histories for entries changed during sync, especially across actor boundaries.

Identify newly added or anomalous federated peers and outbox activity.

Alert on bulk content changes temporally associated with administrator sync actions.

Mitigation and prioritisation

Upgrade to the vendor’s fixed release; prioritise affected internet-accessible deployments.

Until patched, disable ActivityPub sync or restrict federation to trusted peers.

Review and restore affected content from trusted backups or version history.

Test the upgrade and any federation changes in staging, then monitor sync activity after deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.