YesWiki: Replay of captured HTTP Signature requests via ActivityPub inbox
Summary
YesWiki from 4.6.2 before 4.7.0 does not validate the Date header of HTTP Signature requests and does not track signatures it has already seen. An attacker who captures a validly signed request to the ActivityPub inbox of a form (/api/forms/{formId}/actor/inbox) can resend it later and re-execute Delete, Update, Follow or Undo actions. The attacker needs to capture a signed request first, for example from logs or network traffic.
Affected
- YesWiki from 4.6.2 before 4.7.0
- Releases before 4.6.2: Unknown.
Fixed in
- Upgrade to YesWiki 4.7.0.
Workaround
- Unknown. No vendor-documented workaround is known.
- Not sourced: if federation is not needed, disable it or block external access to the inbox path at the reverse proxy until the upgrade is done.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public exploit code indexed in Metasploit or Exploit-DB, and no public Nuclei template listed.
- EPSS: 0.22 % (percentile 13).
Our recommendation
- Upgrade YesWiki to 4.7.0 as soon as possible; this release also fixes other YesWiki issues.
- Check whether ActivityPub federation is enabled and whether the inbox is reachable from the internet.
- If upgrading is delayed, disable federation or restrict access to the inbox path at the reverse proxy.
- Review logs for unexpected Delete, Update, Follow or Undo activities.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7m9j-h553-397x github.com
- VulnCheck advisory: YesWiki HTTP Signature Replay via ActivityPub Inbox www.vulncheck.com
- OffSeq Radar: YesWiki replay protection radar.offseq.com
- ThreatInt CVE record CVE-2026-116825 cve.threatint.com
- OpenCVE CVE-2026-116825 app.opencve.io
- Strix CVE-2026-116825 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:13.
Original description (NVD)
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.