CVE-2026-52767

YesWiki versions 4.6.2 through before 4.6.6 contain a cryptographic signature verification bypass (CWE-347) in HttpSignatureService::verifySignature(). The code checks PHP's openssl_verify() return value with a loose boolean test, so a return of -1 — which OpenSSL's EVP_VerifyFinal() can produce on a failed verification — is treated as truthy, the error is never thrown, and the controller proceeds to process the payload. An unauthenticated network attacker who triggers that -1 condition can submit requests with invalid HTTP signatures that YesWiki silently accepts as verified, spoofing a legitimate signed sender and getting attacker-controlled payloads processed. Any YesWiki instance running an affected version and using the HTTP signature feature is exposed, with high integrity impact and limited availability impact per the CVSS score of 8.2. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS estimates a 0.2% probability of exploitation within 30 days.

What to do: Upgrade YesWiki to version 4.6.6 or later, which corrects the openssl_verify() result handling. If upgrading is not immediately possible, restrict access to endpoints that accept HTTP-signed activity payloads (e.g., via network filtering or allowlisting trusted senders) and monitor for unexpected processed activity submissions. Verify deployed version by checking the instance's release/version information before and after remediation.