CVE-2026-116208 — Vulnerability intelligence
—
Published:
- CVSS
- 7.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.