CVE-2026-52767
Received Received - Intake

Improper Signature Verification in YesWiki

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: GitHub, Inc.

Description
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-52767

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects YesWiki versions 4.6.2 to 4.6.5. It involves a flawed signature verification in HttpSignatureService::verifySignature(). The code incorrectly handles the return value of PHP's openssl_verify() function. When openssl_verify() returns -1 (indicating an error), the code's loose boolean negation (!openssl_verify(...)) treats -1 as truthy, skipping the error check and allowing the system to process attacker-controlled input as valid.

Detection Guidance

This vulnerability can be detected by checking the YesWiki version installed on your system. If the version is between 4.6.2 and 4.6.5, it is vulnerable. Run: grep -r 'YesWiki' /path/to/your/wiki/installation or check the version in the admin panel.

Impact Analysis

An attacker could exploit this to bypass signature verification and send malicious requests to the wiki system. This could allow unauthorized actions, such as modifying wiki content, accessing sensitive data, or executing arbitrary code. The impact depends on the wiki's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's access controls. Organizations using affected YesWiki versions may face compliance violations, potential data breaches, and regulatory penalties if exploited.

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.6 or later to patch the vulnerability. If upgrading is not possible, disable the HttpSignatureService functionality or restrict access to the affected controller to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52767. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart