High severity8.2NVD Advisory· Published Oct 2, 2026· Updated Oct 2, 2026

CVE-2026-104445

Description

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yeswiki/Yeswikillm-fuzzy
Range: <4.6.7

Patches

Vulnerability mechanics

References

github.com/YesWiki/yeswiki/security/advisories/GHSA-rm6r-grfg-4v78nvd
www.vulncheck.com/advisories/yeswiki-before-4.6.7-authentication-bypass-via-activitypub-inbox-actor-spoofingnvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000