Replay Protection Vulnerability in YesWiki Product by YesWiki
CVE-2026-116825

8.3HIGH

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116825?

YesWiki versions from 4.6.2 prior to 4.7.0 are susceptible to a replay attack due to inadequate replay protection within the HttpSignatureService::verifySignature() method. This vulnerability allows attackers to intercept a signed request directed at the /api/forms/{formId}/actor/inbox endpoint. Failing to validate the Date header or track previously seen signatures opens the door for unauthorized users to resend captured requests, potentially executing sensitive actions such as Delete, Update, Follow, or Undo, without proper authorization.

Affected Version(s)

yeswiki 4.6.2 < 4.7.0

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-from-4.6.2-b...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.