Technical impact
The vulnerability resides in the ActivityPubService::syncActorPosts method where an absence of proper authorization checks allows a malicious ActivityPub server to inject forged activities into the sync process. By providing a poisoned outbox that contains cross‑actor Delete, Update, or Create messages, an attacker can cause the host to delete, overwrite, forge, or mass‑delete entries that belong to other actors. The result is a loss of data integrity and availability, with malicious actors able to alter or remove content they should not control.
Affected Systems
YesWiki installations from version 4.6.2 through just before 4.7.0 are affected. The issue applies to the core YesWiki product on any platform that exposes ActivityPub synchronization.
Risk and Exploitability
The CVSS base score of 7.2 indicates a moderate to high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires an attacker to have a malicious ActivityPub actor that can trigger a syncActorPosts call, typically through a self‑triggered sync by an administrator or automated process. Even with this requirement, the impact of mass deletion or data forgery would be significant, warranting timely remediation.
