CVE-2026-104463EPSS p15.4%

CVE-2026-104463CVE-2026-104463

Description

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.

Scoring

CVSS 7.0 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS0.25% probability of exploitation · percentile 15.4% · 2026-10-06T12:00:23Z
Last modified2026-10-02
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.