CVE-2026-52767: YesWiki ActivityPub signature verification bypass in HttpSignatureService

CVE-2026-52767 · Severity: high · CVSS 8.2 · Published 2026-09-05

YesWiki, a collaborative wiki platform, contains a flaw in how it verifies digital signatures for ActivityPub messages. This allows an unauthenticated attacker to bypass security checks and remotely create, modify, or delete content on the wiki. Such an exploit could lead to widespread website defacement, the insertion of malicious links for SEO poisoning, or the deletion of legitimate community contributions.

Technologies: yeswiki/yeswiki (Packagist), YesWiki. Vendors: Packagist, YesWiki.

Quick answers

Is CVE-2026-52767 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52767 being exploited in the wild.
How severe is CVE-2026-52767?
High severity, with a CVSS score of 8.2, published 5 September 2026.
Which products and versions are affected?
yeswiki/yeswiki (Packagist) >= 4.6.2, < 4.6.6, ECOSYSTEM:introduced=4.6.2,fixed=4.6.6; YesWiki >= 4.6.2, < 4.6.6.
Is there a fix for CVE-2026-52767?
Yes. yeswiki/yeswiki (Packagist): upgrade to 4.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52767 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-52767?
Check whether you run yeswiki/yeswiki (Packagist) or YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • yeswiki/yeswiki (Packagist): upgrade to 4.6.6 or later
    composer require yeswiki/yeswiki:^4.6.6

Technical details

The vulnerability exists in `HttpSignatureService::verifySignature()` within `tools/bazar/services/HttpSignatureService.php`. The code uses a loose boolean negation `!openssl_verify(...)` to validate signatures. In certain conditions—such as providing a DSA/EC public key while specifying an RSA algorithm—PHP's `openssl_verify` returns `-1` to indicate an internal error. Because `-1` is truthy in PHP, the negation `!(-1)` evaluates to `false`, causing the application to skip the error-handling block and treat the invalid signature as valid. An attacker can exploit this by hosting a malicious actor document and sending a crafted ActivityPub POST request to the inbox endpoint, gaining unauthorized CRUD access to Bazar entries. This issue is patched in version 4.6.6.

Affected products

  • YesWiki YesWiki >= 4.6.2, < 4.6.6

Identifiers

  • CVE-2026-52767
  • GHSA-mv28-wj57-f57g

Timeline

  • 2026-06-02: advisory: GitHub Advisory published
  • 2026-07-09: disclosed: Public disclosure of CVE-2026-52767

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.