Executive brief
YesWiki, a collaborative wiki platform, contains a flaw in how it verifies digital signatures for ActivityPub messages. This allows an unauthenticated attacker to bypass security checks and remotely create, modify, or delete content on the wiki. Such an exploit could lead to widespread website defacement, the insertion of malicious links for SEO poisoning, or the deletion of legitimate community contributions.
Technical details
The vulnerability exists in `HttpSignatureService::verifySignature()` within `tools/bazar/services/HttpSignatureService.php`. The code uses a loose boolean negation `!openssl_verify(...)` to validate signatures. In certain conditions—such as providing a DSA/EC public key while specifying an RSA algorithm—PHP's `openssl_verify` returns `-1` to indicate an internal error. Because `-1` is truthy in PHP, the negation `!(-1)` evaluates to `false`, causing the application to skip the error-handling block and treat the invalid signature as valid. An attacker can exploit this by hosting a malicious actor document and sending a crafted ActivityPub POST request to the inbox endpoint, gaining unauthorized CRUD access to Bazar entries. This issue is patched in version 4.6.6.
Affected products
- YesWiki YesWiki >= 4.6.2, < 4.6.6
Timeline
- 2026-06-02: advisory: GitHub Advisory published
- 2026-07-09: disclosed: Public disclosure of CVE-2026-52767