What is GHSA-r76f-83xj-prp9?

GHSA-r76f-83xj-prp9 is a security advisory published by GitHub Security Advisories with High severity. YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(...

Which CVE IDs does GHSA-r76f-83xj-prp9 cover?

GHSA-r76f-83xj-prp9 covers the following CVE IDs: CVE-2026-116825. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r76f-83xj-prp9?

GHSA-r76f-83xj-prp9 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-r76f-83xj-prp9HighCVSS 6.5

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(...

Vendor

GitHub Security Advisories

Published

October 27, 2026

Last Modified

October 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-116825 →

📋 Description

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.

🔗 References (4)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7m9j-h553-397x
https://nvd.nist.gov/vuln/detail/CVE-2026-116825
https://www.vulncheck.com/advisories/yeswiki-from-4.6.2-before-4.7.0-http-signature-replay-via-activitypub-inbox
https://github.com/advisories/GHSA-r76f-83xj-prp9