Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104445YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing

High 8.2

In plain English

A high-severity authentication bypass by spoofing in yeswiki from YesWiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.6.7

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

GitHub Security Advisory (GHSA-rm6r-grfg-4v78) vendor-advisory
VulnCheck Advisory: YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing third-party-advisory