YesWiki: Unauthenticated server-side request forgery via ActivityPub inbox
Summary
YesWiki before 4.6.7 allows unauthenticated attackers to make the server send GET and POST requests to arbitrary URLs through the public forms ActivityPub actor inbox. The attacker signs a Follow activity with their own key and supplies internal URLs in the body, which the server never validates. Responses are not directly returned to the attacker, but internal hosts and cloud metadata services can be reached blindly, and ActivityPub must be enabled on at least one form.
Affected
- YesWiki up to and including 4.6.6 (CNA range: all versions before 4.6.7)
- Precondition: ActivityPub enabled on at least one Bazar form
- Conflicting range in a third-party source (4.6.2 to 4.6.7); treat all versions below 4.6.7 as affected
Fixed in
- Fixed in YesWiki 4.6.7
Workaround
- No workaround specific to this CVE is confirmed.
- If an upgrade is not possible immediately, restrict access to the public ActivityPub inbox route (/api/forms/{formId}/actor/inbox) and disable ActivityPub features. This advice comes from a related advisory (CVE-2026-116825) and is not confirmed for this CVE.
Exploitation
- CISA SSVC rates exploitation as "poc", meaning a public proof of concept exists; automatable is "no".
- No reports of active exploitation in the wild were found.
- EPSS: 0.00254.
Our recommendation
- Upgrade all YesWiki instances to 4.6.7 or later.
- Identify all instances and their versions, and check whether ActivityPub is enabled on any form.
- Restrict outbound requests from the web server to internal networks and cloud metadata addresses as defence in depth.
- Patch the related CVEs in the same batch (CVE-2026-104459, CVE-2026-104464, CVE-2026-104445) together.
- Monitor web server logs for requests to /api/forms/ and */actor/inbox from unknown sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-x623-wwf6-f6wp github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-104463 osv.dev
- CNA record via Vulners vulners.com
- YesWiki 4.6.7 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:17.
Original description (NVD)
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.