high8.1
CVE-2026-116208
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers ma…
Impact
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
Affected products
| Product | Affected versions |
|---|---|
| YesWiki From 4.6.2 | before 4.7.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.