An unauthenticated server-side request forgery vulnerability in YesWiki versions 4.6.2 through 4.6.5 poses a critical risk by allowing attackers to interact with internal network resources.

The application is vulnerable to Server-Side Request Forgery (CWE-918) via the POST /api/forms/{formId}/actor/inbox endpoint. An unauthenticated attacker can supply a malicious URL in the HTTP Signature header, forcing the server to perform unauthorized requests to internal infrastructure or cloud metadata services.

Successful exploitation allows an attacker to bypass perimeter security, potentially exposing sensitive internal services or cloud instance metadata. Given the CVSS score of 8.3, this high-severity flaw could lead to significant data breaches or unauthorized access to backend systems. The ability to perform internal reconnaissance makes this a serious threat to any organization hosting YesWiki within a cloud or internal network environment.

Immediate Action: Upgrade YesWiki to version 4.6.6 or later to incorporate the security fix for the signature verification process.

Proactive Monitoring: Review web server and application logs for unusual outbound requests or spikes in traffic to internal IP ranges such as 169.254.169.254.

Compensating Controls: Implement strict egress filtering on the server hosting YesWiki to prevent unauthorized outbound connections to internal network segments or unauthorized external domains.

Public Exploit Available: Unknown.

Organizations utilizing YesWiki must prioritize patching to version 4.6.6 immediately. Because the vulnerability allows unauthenticated access to internal resources, it should be treated with high urgency to prevent potential lateral movement or information disclosure within the network.