Is CVE-2026-63115 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63115 being exploited in the wild.

How severe is CVE-2026-63115?

Medium severity, with a CVSS score of 5.3, published 30 October 2026.

Which products and versions are affected?

Ghost ActivityPub 1.0.0 through 1.2.5.

Is there a fix for CVE-2026-63115?

Yes: fixed in 1.2.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63115 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63115?

Check whether you run Ghost ActivityPub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63115: Ghost ActivityPub Undo handler impersonation

CVE-2026-63115 · Severity: medium · CVSS 5.3 · Published 2026-10-30

Ghost's ActivityPub server is a federated social networking implementation that allows instances to interact across networks. A vulnerability in the Undo handler allows remote federated servers to forge follow or repost removals on behalf of other accounts, letting attackers unfollow or remove reposts that don't belong to them without authorization. Affected relationships can be re-established, and no data is exposed or modified beyond these relationship changes.

Vendors: Ghost.

Quick answers

Is CVE-2026-63115 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63115 being exploited in the wild.
How severe is CVE-2026-63115?: Medium severity, with a CVSS score of 5.3, published 30 October 2026.
Which products and versions are affected?: Ghost ActivityPub 1.0.0 through 1.2.5.
Is there a fix for CVE-2026-63115?: Yes: fixed in 1.2.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63115 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63115?: Check whether you run Ghost ActivityPub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.2.6

Technical details

The Undo handler in versions 1.0.0–1.2.5 lacks validation that the actor initiating an Undo activity matches the actor who performed the original Follow or Announce (repost) activity. An attacker controlling a remote federated server can send an Undo activity that references another account's follow or repost, causing the local instance to remove it. The fix adds identity verification to ensure the Undo actor matches the nested activity's actor before processing.

Affected products

Ghost ActivityPub 1.0.0 through 1.2.5

Timeline

2026-10-30: disclosed
2026-06-24: patched: Fix merged in commit 1526f540b983da97750b380868a210e6cdfb985e

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.