CVE-2026-52769

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.6.2 through 4.6.5

Description An unauthenticated remote attacker can perform a Server-Side Request Forgery (SSRF) by sending a specially crafted HTTP request to the POST /api/forms/{formId}/actor/inbox endpoint. The issue occurs because the HttpSignatureService::verifySignature() function parses the Signature header and immediately performs a server-side HTTP GET request to the URL provided in the keyId parameter before any cryptographic verification or URL validation takes place. This allows an attacker to force the server to make arbitrary outbound requests to internal services, cloud-metadata endpoints (such as 169.254.169.254), or intranet-only admin panels. By analyzing timing and error-message oracles, an attacker can scan ports, enumerate services, and potentially access IAM metadata on cloud instances. This issue is exploitable if ActivityPub is enabled on at least one Bazar form (configured via bn activitypub enable = '1').

Recommendations Update YesWiki to version 4.6.6. As a temporary mitigation, disable the ActivityPub feature on all Bazar forms by setting bn activitypub enable to '0'.