CVE-2026-52769

YesWiki (PHP wiki system) versions 4.6.2 through before 4.6.6 contain an unauthenticated Server-Side Request Forgery (SSRF) in the ActivityPub inbox endpoint. The route POST /api/forms/{formId}/actor/inbox (public ACL) passes the attacker-controlled keyId URL from the HTTP Signature header direct...