---
id: CVE-2026-63115
title: >-
  ActivityPub Undo handler can unfollow or remove reposts on behalf of other
  accounts
summary: >-
  ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify.
  From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to
  cause the service to act on a `follow` or `repost` as though the activity came
  …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-290
  - CWE-345
  - CWE-863
vendor: TryGhost
product: ActivityPub
affected:
  - 'ActivityPub >= 1.0.0, < 1.2.6'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T17:12:41.067713Z'
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:09:53.602Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63115'
references:
  - url: >-
      https://github.com/TryGhost/ActivityPub/security/advisories/GHSA-mm4q-93gr-5mwc
    label: >-
      https://github.com/TryGhost/ActivityPub/security/advisories/GHSA-mm4q-93gr-5mwc
  - url: 'https://github.com/TryGhost/ActivityPub/pull/1929'
    label: 'https://github.com/TryGhost/ActivityPub/pull/1929'
  - url: >-
      https://github.com/TryGhost/ActivityPub/commit/1526f540b983da97750b380868a210e6cdfb985e
    label: >-
      https://github.com/TryGhost/ActivityPub/commit/1526f540b983da97750b380868a210e6cdfb985e
  - url: 'https://github.com/TryGhost/ActivityPub/releases/tag/v1.2.6'
    label: 'https://github.com/TryGhost/ActivityPub/releases/tag/v1.2.6'
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03644
ingestedAt: '2026-11-05T19:30:42.766Z'
---

## Overview

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship or `repost` belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.

## Affected

- `ActivityPub >= 1.0.0, < 1.2.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.