Summary
YesWiki contains a missing authorization check in ActivityPub synchronization that can allow a malicious ActivityPub server to manipulate entries mirrored from other actors.
During an administrator-initiated sync, forged Delete, Update, or Create activities may delete, overwrite, fabricate, or mass-delete content when the remote activity is not properly authorized for the target actor.
YesWiki contains a missing authorization check in ActivityPub synchronization that can allow a malicious ActivityPub server to manipulate entries mirrored from other actors.
During an administrator-initiated sync, forged Delete, Update, or Create activities may delete, overwrite, fabricate, or mass-delete content when the remote activity is not properly authorized for the target actor.
Affected context
The vulnerability affects YesWiki deployments using ActivityPub synchronization in the affected 4.6.x release range before 4.7.0. It becomes risky when an administrator initiates actor-post synchronization and the application accepts remote activities without confirming that the source server and actor are authorized to modify the mirrored entry.
The vulnerability affects YesWiki deployments using ActivityPub synchronization in the affected 4.6.x release range before 4.7.0. It becomes risky when an administrator initiates actor-post synchronization and the application accepts remote activities without confirming that the source server and actor are authorized to modify the mirrored entry.
Exploit preconditions
- Attack surface: ActivityPub actor-post synchronization
- Required access: Ability to operate or control an ActivityPub server or actor whose content is retrieved during synchronization
- Trigger point: An administrator-initiated sync of ActivityPub actor posts
- Why exploitation is possible: The synchronization path does not adequately verify authorization and actor ownership before applying Delete, Update, or Create activities to mirrored entries
- Attack surface: ActivityPub actor-post synchronization
- Required access: Ability to operate or control an ActivityPub server or actor whose content is retrieved during synchronization
- Trigger point: An administrator-initiated sync of ActivityPub actor posts
- Why exploitation is possible: The synchronization path does not adequately verify authorization and actor ownership before applying Delete, Update, or Create activities to mirrored entries
Why this happens
The underlying bug is a missing authorization check in the synchronization workflow. Remote ActivityPub activities are treated as sufficient authority to alter locally mirrored content without reliably binding the operation to the actor and entry it claims to control.
This maps to CWE-862: Missing Authorization, where an application fails to enforce an access-control decision before performing a protected action. The insecure pattern is trusting externally supplied actor or activity identifiers when deciding which local records may be created, changed, or deleted.
The underlying bug is a missing authorization check in the synchronization workflow. Remote ActivityPub activities are treated as sufficient authority to alter locally mirrored content without reliably binding the operation to the actor and entry it claims to control.
This maps to CWE-862: Missing Authorization, where an application fails to enforce an access-control decision before performing a protected action. The insecure pattern is trusting externally supplied actor or activity identifiers when deciding which local records may be created, changed, or deleted.
Potential impact
- An attacker may delete mirrored entries belonging to other actors.
- An attacker could overwrite legitimate content with manipulated data.
- Attackers may forge entries that appear to originate from trusted actors.
- A poisoned outbox could cause widespread or mass deletion during synchronization.
- Content integrity, availability, and user trust may be affected.
- An attacker may delete mirrored entries belonging to other actors.
- An attacker could overwrite legitimate content with manipulated data.
- Attackers may forge entries that appear to originate from trusted actors.
- A poisoned outbox could cause widespread or mass deletion during synchronization.
- Content integrity, availability, and user trust may be affected.
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the point where each remote activity is applied.
Common defensive patterns include:
- Verify that the activity's actor is authorized to create, update, or delete the referenced local entry.
- Bind remote identifiers and ownership metadata to the specific actor and source server that originally established the mirror.
- Reject cross-actor operations and ambiguous or inconsistent activity relationships by default.
- Apply strict validation and replay protections before mutating local records.
- Limit synchronization privileges and isolate imported content from trusted local content.
- Use least-privilege service accounts and require review or controlled workflows for high-impact bulk synchronization.
Mitigation generally focuses on enforcing authorization at the point where each remote activity is applied.
Common defensive patterns include:
- Verify that the activity's actor is authorized to create, update, or delete the referenced local entry.
- Bind remote identifiers and ownership metadata to the specific actor and source server that originally established the mirror.
- Reject cross-actor operations and ambiguous or inconsistent activity relationships by default.
- Apply strict validation and replay protections before mutating local records.
- Limit synchronization privileges and isolate imported content from trusted local content.
- Use least-privilege service accounts and require review or controlled workflows for high-impact bulk synchronization.
How teams detect issues like this
High-level detection approaches include:
- Static analysis and code review for synchronization paths that mutate records without an explicit authorization decision.
- Searching for delete, update, and create handlers that trust remote actor identifiers or object references directly.
- Reviewing whether ownership and source-server checks occur before database mutations.
- Monitoring synchronization logs for cross-actor activity, unexpected bulk deletions, or updates to entries outside the initiating actor's scope.
- Enforcing policy checks that require authorization tests for every externally triggered data mutation.
- Using automated code review or application-security tooling to identify missing access-control checks, while validating findings against the synchronization design.
High-level detection approaches include:
- Static analysis and code review for synchronization paths that mutate records without an explicit authorization decision.
- Searching for delete, update, and create handlers that trust remote actor identifiers or object references directly.
- Reviewing whether ownership and source-server checks occur before database mutations.
- Monitoring synchronization logs for cross-actor activity, unexpected bulk deletions, or updates to entries outside the initiating actor's scope.
- Enforcing policy checks that require authorization tests for every externally triggered data mutation.
- Using automated code review or application-security tooling to identify missing access-control checks, while validating findings against the synchronization design.
