CVE-2026-104463

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.

CVSS 4.0

8.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)

CWE

CWE-918

Published

2026-10-02

Modified

2026-10-02

Record from

the NVD, synced 2026-10-19

References

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x623-wwf6-f6wp
• https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-unauthenticated-ssrf-via-activitypub-inbox
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x623-wwf6-f6wp

Check your stackJSON