Description
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| YesWiki | yeswiki | 4.6.2 – < 4.7.0 | 4.7.0 |
References
- GitHub Security Advisory (GHSA-cr64-h6xp-9g2j) vendor-advisory
- VulnCheck Advisory: YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts third-party-advisory