CVE-2026-52767 Details
Description
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.
A vulnerability exists in YesWiki versions 4.6.2 prior to 4.6.6, allowing for a bypass in the ActivityPub signature verification process. The issue arises in the 'HttpSignatureService::verifySignature()' method, where the result of PHP's 'openssl_verify()' is evaluated with a loose boolean negation. This misinterpretation allows an attacker to manipulate the verification process, leading to unauthorized actions being processed as legitimate. The flaw can be exploited by sending a specially crafted signature that causes 'openssl_verify()' to return -1, which is treated as a successful verification. As a result, the application unknowingly processes the attacker's payload, potentially leading to unauthorized changes or injections within the wiki content.
Users are advised to upgrade to YesWiki version 4.6.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-mv28-wj57-f57g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/YesWiki/yeswiki/commit/d1795e0301e1a1078f17b4b98f56fff70de2029e | [email protected] | Source CodeVendor |
| https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 | [email protected] | Release NotesVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-mv28-wj57-f57g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | v4.6.2 (semver) v4.6.3 (semver) v4.6.4 (semver) v4.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |