Is CVE-2026-116208 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116208?

CVE-2026-116208 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-116208

Description

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.