Vulnerability Description
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x623-wwf6-f6wp
- https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-unauthenticated-ssrf-v
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x623-wwf6-f6wp
FAQ
What is CVE-2026-104463?
CVE-2026-104463 is a vulnerability with a CVSS score of 7.0 (HIGH). YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor...
How severe is CVE-2026-104463?
CVE-2026-104463 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-104463?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.