CVE-2026-104445 Overview
CVE-2026-104445 is an authentication bypass vulnerability affecting YesWiki versions before 4.6.7. The flaw resides in the ActivityPub inbox handler, which fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers who possess any valid ActivityPub keypair can send signed Delete or Update activities that reference a mirrored entry's sourceUrl. The server processes these forged activities as if they came from the legitimate actor, allowing attackers to delete or overwrite federated entries belonging to other users. The weakness is classified under [CWE-290: Authentication Bypass by Spoofing].
Critical Impact
Remote unauthenticated attackers can forge ActivityPub Delete and Update activities to tamper with or destroy federated content belonging to any mirrored actor.
Affected Products
- YesWiki versions prior to 4.6.7
- YesWiki instances with ActivityPub federation enabled
- Federated YesWiki deployments mirroring remote entries
Discovery Timeline
- 2026-10-02 - CVE-2026-104445 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104445
Vulnerability Analysis
YesWiki implements ActivityPub federation to synchronize wiki entries across instances. The inbox endpoint accepts signed activities and verifies HTTP signatures to authenticate the sender. The vulnerability stems from an incomplete authorization check: the inbox verifies that the HTTP signature is cryptographically valid, but it does not verify that the signer identity matches the actor field in the activity payload.
This decoupling of signer and actor allows any party controlling an ActivityPub keypair to assert actions on behalf of unrelated actors. Because YesWiki looks up mirrored entries by sourceUrl, an attacker can target any federated entry by crafting an activity that references the victim's sourceUrl while using the attacker's own key for signature validation.
Root Cause
The root cause is a missing binding between the authenticated HTTP signature signer and the activity actor claimed in the request body. The inbox code path trusts the actor field after signature verification succeeds, without confirming that the public key used to verify the signature belongs to that actor. This is a classic [CWE-290] spoofing weakness in the federation trust model.
Attack Vector
The attack requires only network access to the vulnerable YesWiki ActivityPub inbox and no prior authentication to the target instance. An attacker generates an ActivityPub keypair and hosts a minimal actor document. The attacker then crafts a Delete or Update activity whose object references the sourceUrl of a mirrored entry on the target instance. The request is signed with the attacker's own private key.
Upon receipt, the YesWiki inbox verifies the signature against the attacker's published public key and accepts the activity. The handler then applies the operation to the mirrored entry, deleting it or overwriting its content, despite the attacker having no relationship to the original actor.
No verified public exploit code is available. Technical details are published in the GitHub Security Advisory and the VulnCheck Advisory for YesWiki.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104445
Indicators of Compromise
- Unexpected Delete or Update ActivityPub activities received at the /activitypub/inbox endpoint from unfamiliar actor domains.
- Mirrored federated entries that disappear or change content without corresponding activity from the originating instance.
- HTTP signature headers where the keyId host does not match the actor host referenced in the activity payload.
Detection Strategies
- Inspect web server access logs for POST requests to the ActivityPub inbox with Delete or Update activity types from previously unseen remote hosts.
- Correlate inbox activity signer domains against the actor domains in the request body to flag mismatches.
- Audit YesWiki entry revision history for unexplained deletions or overwrites tied to federated sourceUrl values.
Monitoring Recommendations
- Enable verbose logging on the ActivityPub inbox handler to capture signer keyId, actor URI, and target sourceUrl for every inbound activity.
- Alert on high-volume Delete activities or activities targeting entries from a different origin than the signer.
- Monitor outbound federation errors indicating that remote peers are retransmitting activities that the local instance already processed.
How to Mitigate CVE-2026-104445
Immediate Actions Required
- Upgrade YesWiki to version 4.6.7 or later, which binds the HTTP signature signer to the activity actor during inbox processing.
- Review federated entry revision history and restore any entries deleted or modified by unauthorized Delete or Update activities.
- Rotate any ActivityPub signing keys that may have been exposed and audit the trust store of known federated peers.
Patch Information
The YesWiki maintainers released version 4.6.7 to address CVE-2026-104445. The fix enforces that the public key used to verify the HTTP signature must belong to the actor named in the activity payload. Administrators should apply the upgrade immediately per the GitHub Security Advisory.
Workarounds
- Temporarily disable the ActivityPub federation feature in YesWiki configuration until the patch is applied.
- Restrict access to the ActivityPub inbox endpoint at the reverse proxy, allowing only a trusted allowlist of federated peer domains.
- Deploy a web application firewall rule that rejects inbound ActivityPub activities whose keyId domain does not match the actor domain.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
