{"id":"CVE-2026-116825","title":"YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox","summary":"YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-294"],"vendor":"YesWiki","product":"yeswiki","affected":["yeswiki >= 4.6.2 < 4.7.0"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T23:05:50.597Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116825","references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7m9j-h553-397x","label":"GitHub Security Advisory (GHSA-7m9j-h553-397x)"},{"url":"https://www.vulncheck.com/advisories/yeswiki-from-4.6.2-before-4.7.0-http-signature-replay-via-activitypub-inbox","label":"VulnCheck Advisory: YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox"}],"tags":["cve.org"],"epss":0.00225,"epssPercentile":0.13117,"ingestedAt":"2026-10-27T16:11:59.148Z","slug":"CVE-2026-116825","body":"## Overview\n\nYesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.\n\n## Affected\n\n- `yeswiki >= 4.6.2 < 4.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}