Activitypub
Monthly
Replay of previously signed ActivityPub requests against YesWiki's public /api/forms/{formId}/actor/inbox endpoint lets an attacker re-execute captured Delete, Update, Follow or Undo actions at any later time, because HttpSignatureService::verifySignature() never validates the Date header and keeps no record of seen signatures. YesWiki from 4.6.2 through 4.6.7 is affected, and the 5.0.0-alpha1 prerelease also lacks the guard; the vendor fix is 4.7.0. Exploitation is gated by the need to first obtain a valid signed request (reverse-proxy logs, WAF/IDS logs, application debug output or shared-hosting co-tenancy), which is consistent with the low EPSS score of 0.22% (13th percentile) and the absence of a CISA KEV listing; a public PoC reference exists but it is not verified as working exploit code, and the attacker cannot forge new actions - only replay captured ones.
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.
Missing actor-identity and object-ownership checks in the Discourse ActivityPub plugin allow remote attackers to edit, delete, or reply to federated posts without the permissions those actions normally require. Because inbound ActivityPub processing trusts the Activity actor declared inside the payload rather than the actor authenticated by the request's HTTP signature, anyone who can produce a valid HTTP signature for any federated actor can operate on posts that actor does not own; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms no account on the target Discourse instance is needed, with the impact being unauthorized modification rather than data exposure. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), though the fixing commit is publicly visible and the affected CPE entry spans all plugin versions prior to that commit. Exposure is limited to Discourse instances that have installed and enabled the ActivityPub federation plugin, since stock Discourse does not ship it.
Improper access control in the ActivityPub WordPress plugin before 8.0.2 exposes draft, scheduled, and pending posts to unauthenticated remote users, resulting in confidentiality breach. This information disclosure vulnerability (CVSS 7.5) allows network-based attackers to access unpublished content without authentication or user interaction. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). EPSS score of 0.02% (6th percentile) suggests low current exploitation probability despite POC availability, but SSVC framework marks it as automatable with partial technical impact.
Ghost's ActivityPub service (self-hosted activitypub image, v1.0.0 through v1.2.5) fails to verify that an incoming Undo activity's actor matches the actor of the original Follow or Announce, letting a remote federated server unfollow or strip a repost belonging to another account without that account's involvement. The impact is integrity-only and re-establishable: no private data is exposed and no content is modified, which matches the assessed CVSS 5.3 vector (network, no privileges or interaction, integrity low only). Only self-hosters running their own activitypub deployment with federation enabled are exposed, since Ghost Pro hosted instances at ap.ghost.org were already updated; fixes are released in v1.2.6 and there is no public exploit identified at time of analysis.
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Replay of previously signed ActivityPub requests against YesWiki's public /api/forms/{formId}/actor/inbox endpoint lets an attacker re-execute captured Delete, Update, Follow or Undo actions at any later time, because HttpSignatureService::verifySignature() never validates the Date header and keeps no record of seen signatures. YesWiki from 4.6.2 through 4.6.7 is affected, and the 5.0.0-alpha1 prerelease also lacks the guard; the vendor fix is 4.7.0. Exploitation is gated by the need to first obtain a valid signed request (reverse-proxy logs, WAF/IDS logs, application debug output or shared-hosting co-tenancy), which is consistent with the low EPSS score of 0.22% (13th percentile) and the absence of a CISA KEV listing; a public PoC reference exists but it is not verified as working exploit code, and the attacker cannot forge new actions - only replay captured ones.
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.
Missing actor-identity and object-ownership checks in the Discourse ActivityPub plugin allow remote attackers to edit, delete, or reply to federated posts without the permissions those actions normally require. Because inbound ActivityPub processing trusts the Activity actor declared inside the payload rather than the actor authenticated by the request's HTTP signature, anyone who can produce a valid HTTP signature for any federated actor can operate on posts that actor does not own; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms no account on the target Discourse instance is needed, with the impact being unauthorized modification rather than data exposure. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), though the fixing commit is publicly visible and the affected CPE entry spans all plugin versions prior to that commit. Exposure is limited to Discourse instances that have installed and enabled the ActivityPub federation plugin, since stock Discourse does not ship it.
Improper access control in the ActivityPub WordPress plugin before 8.0.2 exposes draft, scheduled, and pending posts to unauthenticated remote users, resulting in confidentiality breach. This information disclosure vulnerability (CVSS 7.5) allows network-based attackers to access unpublished content without authentication or user interaction. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). EPSS score of 0.02% (6th percentile) suggests low current exploitation probability despite POC availability, but SSVC framework marks it as automatable with partial technical impact.
Ghost's ActivityPub service (self-hosted activitypub image, v1.0.0 through v1.2.5) fails to verify that an incoming Undo activity's actor matches the actor of the original Follow or Announce, letting a remote federated server unfollow or strip a repost belonging to another account without that account's involvement. The impact is integrity-only and re-establishable: no private data is exposed and no content is modified, which matches the assessed CVSS 5.3 vector (network, no privileges or interaction, integrity low only). Only self-hosters running their own activitypub deployment with federation enabled are exposed, since Ghost Pro hosted instances at ap.ghost.org were already updated; fixes are released in v1.2.6 and there is no public exploit identified at time of analysis.
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.