CVE-2026-52767
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in HttpSignatureService::verifySignature(), which checks the result of openssl_verify() with a loose boolean negation. Since PHP treats -1 as truthy, the condition !(-1) is false, causing the error to be skipped and processing to continue even when signature verification failed.
Risk Assessment
An attacker can bypass signature verification and send unauthorized requests that are processed as valid, potentially leading to unauthorized actions in the system.
Recommendation
Upgrade to version 4.6.6 and fix the verification logic to explicitly check for value 1.
Other vulnerabilities in YesWiki
See all- CVE-2026-116208High
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync.
- CVE-2026-116204High
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts parameters that delete PagePrincipale, configuration pages, or overwrite current content.
- CVE-2026-104472High
Missing authorization in the attachment download handler in YesWiki before 4.6.7 allows unauthenticated attackers to bypass page read ACLs. They can retrieve confidential attachments from read-restricted pages by knowing the page tag and file parameter.
- CVE-2026-104471High
Unrestricted file upload in YesWiki before 4.6.7 allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. They can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
- CVE-2026-104468Medium
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability because password reset tokens lack expiry timestamps. An attacker who obtains an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.
- CVE-2026-104467High
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.
- CVE-2026-104466Medium
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php. Users who can edit pages or post comments can inject event handlers by placing quotes in markdown image URLs, leading to JavaScript execution in viewers' browsers, including administrators.
- CVE-2026-104464High
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.
- CVE-2026-104463High
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
- CVE-2026-104462High
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
Original NVD description (English source)
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS