Skip to content
OpenAdvisories

Product · TryGhost

ActivityPub

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-63115

    ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

    ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different accou…

    TryGhost ActivityPub