YesWiki: Authentication bypass in ActivityPub inbox via actor spoofing

Summary

YesWiki contains an authentication bypass in its ActivityPub inbox. The inbox verifies the HTTP signature of a request but never checks that the verified key owner is the actor named in the activity. An unauthenticated attacker with any ActivityPub keypair can send signed Delete or Update activities that reference a mirrored entry's sourceUrl, which deletes or overwrites federated entries belonging to other actors. The attack requires that ActivityPub is enabled on at least one Bazar form; the CNA rates it CVSS 4.0 8.8 (High), with impact on integrity and some availability.

Affected

• Vendor advisory (GHSA-rm6r-grfg-4v78): YesWiki (Composer package yeswiki/yeswiki) >= 4.6.2, < 4.7.0.
• CNA record (VulnCheck): all versions before 4.6.7.
• The two sources conflict. Versions before 4.6.2 should be treated as affected until the vendor advisory confirms otherwise.
• Requires ActivityPub federation to be enabled on at least one Bazar form.

Fixed in

• Upgrade to YesWiki 4.7.0 (fixed version per vendor advisory).
• The CNA record lists 4.6.7 as unaffected. Check the vendor advisory before choosing the target version, and use 4.7.0 or later if in doubt.

Workaround

• No vendor-documented workaround. Only the upgrade is confirmed.
• Until the upgrade is done, disable ActivityPub on Bazar forms if federation is not needed, or restrict network access to POST /api/forms/{formId}/actor/inbox. This is not confirmed for this CVE but removes the attack surface.

Exploitation

• Not on the CISA KEV catalogue; no known exploitation.
• No public proof of concept or exploit code found.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS about 0.4 percent. VulDB lists the status as 0-Day at disclosure, which reflects timing only.

Our recommendation

• Identify all YesWiki instances, including unmaintained ones, and check whether ActivityPub is enabled.
• Upgrade to 4.7.0 or later (see fixed versions). One upgrade also covers the related CVE-2026-104463 and CVE-2026-104458 fixed in the same release.
• If ActivityPub is not needed, disable it now.
• Review federated entries for unexpected deletions or changes and restore from backup where needed.
• Monitor web server logs for POST requests to the actor inbox endpoint.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-rm6r-grfg-4v78 github.com
• VulnCheck advisory www.vulncheck.com
• OSV CVE-2026-104445 osv.dev
• CNA record via Vulners (CVELIST) vulners.com
• Mend entry via Vulners vulners.com
• VulDB 413088 vuldb.com
• OpenCVE CVE-2026-104445 app.opencve.io
• Related advisory CVE-2026-104458 (ionix.io) www.ionix.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:51.