Threats tagged 'ghsa-r76f-83xj-prp9'

YesWiki versions from 4.6.2 up to but not including 4.7.0 have a vulnerability in the HttpSignatureService::verifySignature() method where replay protection is missing. Specifically, the method does not validate the Date header nor track previously seen signatures. This allows an attacker who captures a signed request to the /api/forms/{formId}/actor/inbox endpoint to replay that request later, potentially re-executing sensitive actions such as Delete, Update, Follow, or Undo.