YesWiki CVE-2026-104459

Exploitation requires that the YesWiki instance expose the ActivityPub/WebFinger functionality - specifically the 'abonnements' view backed by WebfingerService - to the attacker, and that the attacker can supply an actor_handle with a numeric host and port. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required against affected default-reachable deployments of YesWiki before 4.6.7. The primary limiting factors are: the instance must be running a vulnerable version (<4.6.7), the WebFinger/subscription feature must be reachable, and impact is constrained to triggering outbound HTTPS requests to numeric hosts/ports (internal service and port probing) rather than arbitrary-scheme or full-response SSRF.

This is a moderate-priority vulnerability. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which raises its real-world accessibility. However, the impact is deliberately scoped: VC:L and VA:L with VI:N, consistent with an SSRF that enables internal probing/port-scanning rather than full data exfiltration or code execution - the base score of 6.9 (Medium) reflects this limited impact. No EPSS score was provided, and exploitation status is 'no public exploit identified at time of analysis' (not in CISA KEV, no POC referenced). The signals are internally consistent: a genuinely easy-to-reach bug with a bounded blast radius. It is a real issue worth patching promptly for internet-exposed YesWiki instances, but it is not a drop-everything critical - it is a stepping-stone/reconnaissance primitive (internal HTTPS service and port discovery) rather than a direct compromise. Note the vector limits SSRF to HTTPS requests against numeric hosts/ports via the WebfingerService, which narrows but does not eliminate pivoting potential.

An unauthenticated attacker sends a POST request to the abonnements view containing a crafted ActivityPub actor_handle whose host is a numeric internal IP and whose port targets an internal HTTPS service. YesWiki's WebfingerService issues the outbound HTTPS request on the attacker's behalf, and differences in response or timing let the attacker enumerate reachable internal hosts and open ports behind the firewall. No public exploit is identified at time of analysis, but exploitation is straightforward given AC:L and PR:N.