This vulnerability is a server‑side request forgery (CWE‑918) that lets an unauthenticated attacker send signed Follow activities to the public actor inbox endpoint. By signing the request with a key identifier of their choice while embedding internal actor URLs in the activity payload, the attacker can cause the YesWiki server to perform blind HTTP GET or POST requests to internal hosts or cloud metadata services. The flaw allows the attacker to read or cause actions on any internal resource reachable by the server, potentially exposing sensitive data or enabling further exploitation.

Affected are YesWiki software versions before 4.6.7. The product is YesWiki YesWiki; all deployments using any release older than 4.6.7 are vulnerable. No additional vendor or product variants are listed.

The CVSS score of 8.3 marks this issue as high severity. With no publicly documented exploit yet and an unpublished EPSS, the risk is judged high due to the ability to reach internal services without authentication. The attacker can exploit a publicly exposed API endpoint that accepts JSON objects with a signed keyId, making the flaw easy to trigger. Because the flaw can be exercised through blind external requests, it poses a large attack surface for internal network compromise, but the lack of KEV listing suggests no large‑scale exploitation yet.