Skip to content
CVE-2026-116208: YesWiki Vulnerability Exposes Data Integrity Risks

CVE-2026-116208: YesWiki Vulnerability Exposes Data Integrity Risks

First seen 26 Oct 2026, 07:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 12:42 UTC
  • •YesWiki versions 4.6.2 and earlier are vulnerable to CVE-2026-116208.
  • •Attackers can manipulate content through unauthorized ActivityPub sync operations.
  • •Immediate upgrading to version 4.7.0 is recommended to mitigate risks.

YesWiki versions 4.6.2 and earlier contain a missing authorization vulnerability in the ActivityPubService::syncActorPosts function, allowing malicious ActivityPub servers to manipulate mirrored entries. This could lead to unauthorized deletion, overwriting, or mass deletion of community content, posing high risks to data integrity and availability. The vulnerability has a CVSS score of 7.2, indicating a high severity. Organizations using YesWiki with ActivityPub federation enabled are particularly vulnerable, especially if syncing with untrusted peers. Attackers may exploit this vulnerability to deface or falsify information, disrupt services, or damage reputations. While the urgency of active exploitation remains uncertain, administrators are advised to review sync logs and audit content changes. A patch has been released in version 4.7.0, and users are urged to upgrade immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-25
CVE-2026-116208 published
The vulnerability was officially disclosed with a CVSS score of 7.2, indicating high severity.
www.vulncheck.com
2026-10-26
CVE-2026-116208 details released
Redpacketsecurity published an alert detailing the risks and recommended mitigations for affected YesWiki versions.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-116208 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions are affected?
YesWiki versions 4.6.2 and earlier are affected by CVE-2026-116208.
What should I do if I'm affected?
Upgrade to YesWiki version 4.7.0 immediately to mitigate the vulnerability.
Is there any evidence of exploitation?
The current status of active exploitation is uncertain, as no specific incidents have been reported.