High severity · published Oct 2, 2026
CVE-2026-104445
YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
yeswiki · YesWiki
before 4.6.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104445
vendor-advisory
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-rm6r-grfg-4v78
third-party-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-authentication-bypass-via-activitypub-inbox-actor-spoofing
More from yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
9.8
CVE-2025-46347
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…