Ghost ActivityPub CVE-2026-63115

Requires that the target run the self-hosted Ghost ActivityPub service at an affected version (v1.0.0-v1.2.5) with federation active so that its inbox accepts and processes delivered activities from remote servers; the attacker must control or use a federated ActivityPub server capable of delivering a crafted Undo activity. No authentication is required against the target (PR:N) because federation inbox delivery is unauthenticated, and no user interaction is needed. Limiting factors that reduce real-world risk: impact is confined to removing an existing follow relationship or repost (integrity-only, re-establishable), no private data is exposed and no content is modified; Ghost Pro hosted instances (ap.ghost.org) are already fixed and need no action, so only self-hosters running their own activitypub image before v1.2.6 are exposed. The advisory states there is no application-level workaround; operators who cannot update can only reduce exposure by restricting which federated servers may reach the inbox at the network/proxy layer, which also limits normal federation.

This is a moderate-severity integrity flaw (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) rooted in CWE-290/CWE-345/CWE-863: the Undo handler failed to verify that the Undo activity's actor matched the actor of the original Follow or Announce, so a remote federated server could remove another account's follow relationship or repost. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with the limited impact: integrity-only (I:L), no confidentiality or availability loss, and the affected relationships can be re-established. Exploitation status is 'no public exploit identified at time of analysis' - the only code references are the vendor fix (PR #1929, fix commit, release v1.2.6), which are remediation artifacts, not exploit code; there is no KEV listing and no EPSS score was supplied, so widespread or automated exploitation is not evidenced. The network-unauthenticated vector is real because any federated peer can deliver to the inbox, but the payoff is low (nuisance-level social-graph tampering), so this reads as a genuine but non-urgent fix rather than a high-priority emergency. Missing signals to note explicitly: no EPSS, no KEV, and no independent confirmation of in-the-wild abuse.

A malicious or compromised federated ActivityPub server crafts an Undo activity whose actor is itself but whose embedded Follow or Announce object belongs to a different, legitimate account, then delivers it to a vulnerable Ghost ActivityPub inbox (v1.0.0-1.2.5). Because the pre-patch handler did not confirm the Undo actor matched the original activity's actor, the service removes the victim account's follow relationship or repost on their behalf. No public working exploit is identified; only the vendor fix is published, though the simple logic makes the attack trivially reproducible from the advisory.