CVE-2026-116208
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Oct 25, 2026
Vendor
unknown
Description
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.