What is GHSA-px48-25j6-h73c?

GHSA-px48-25j6-h73c is a security advisory published by GitHub Security Advisories with High severity. YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox...

Which CVE IDs does GHSA-px48-25j6-h73c cover?

GHSA-px48-25j6-h73c covers the following CVE IDs: CVE-2026-104445. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-px48-25j6-h73c?

GHSA-px48-25j6-h73c has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

GHSA-px48-25j6-h73cHighCVSS 8.2

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-104445 →

📋 Description

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.

🔗 References (4)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-rm6r-grfg-4v78
https://nvd.nist.gov/vuln/detail/CVE-2026-104445
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-authentication-bypass-via-activitypub-inbox-actor-spoofing
https://github.com/advisories/GHSA-px48-25j6-h73c