CVE-2026-52767

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.6.2 through 4.6.5

Description An authentication bypass exists in the ActivityPub implementation due to the incorrect handling of the return value from the openssl verify() function in HttpSignatureService::verifySignature(). The application uses a loose boolean negation to check the result, which fails to account for the fact that openssl verify() can return -1 to indicate an internal verification error. In PHP, -1 is treated as a truthy value, causing the application to skip the exception and treat a failed signature verification as a success.

An attacker can trigger this state by providing a DSA or EC public key while specifying an RSA-only verification algorithm. This allows an unauthenticated attacker to perform create, update, or delete operations on Bazar entries via the /api/forms/{enabled-form-id}/actor/inbox endpoint. The practical impact includes content injection, defacement, spam, SEO poisoning, and the deletion of legitimate federated content.

Recommendations Update YesWiki to version 4.6.6. As a temporary mitigation, restrict access to the /api/forms/{enabled-form-id}/actor/inbox endpoint to trusted sources only.