{"id":"CVE-2026-104463","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-104463","generatedAt":"2026-10-27T23:59:06.311Z","title":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route.","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.","published":"2026-10-02T12:17:19.000Z","lastModified":"2026-10-02T14:17:09.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.3,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-918"],"affected":[],"epss":{"score":0.00254,"percentile":0.16722,"date":"2026-10-26","history":[{"date":"2026-10-03","score":0.00254,"percentile":0.15338}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-02T12:17:19.000Z","detail":{"score":"8.3","severity":"HIGH","publishedAt":"2026-10-02T12:17:18.643Z"},"summary":"New CVE, high severity (CVSS 8.3)."}],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x623-wwf6-f6wp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-unauthenticated-ssrf-via-activitypub-inbox","source":"disclosure@vulncheck.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x623-wwf6-f6wp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-104463","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}