{"id":"CVE-2026-52767","title":"YesWiki is a wiki system written in PHP","summary":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ..…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cwe":["CWE-347"],"vendor":"YesWiki","product":"yeswiki","affected":["yeswiki >= 4.6.2, < 4.6.6"],"patched":["yeswiki/yeswiki 4.6.6"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:05:26.920","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52767","references":[{"url":"https://github.com/YesWiki/yeswiki/commit/d1795e0301e1a1078f17b4b98f56fff70de2029e","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-mv28-wj57-f57g","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-mv28-wj57-f57g","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-mv28-wj57-f57g"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"epss":0.0022,"epssPercentile":0.12725,"aliases":["GHSA-mv28-wj57-f57g"],"ecosystem":"composer","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T17:51:20.326023Z"},"ingestedAt":"2026-07-09T21:52:34.694Z","slug":"CVE-2026-52767","body":"## Overview\n\nYesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and \"false\". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52767)\n\nAffected packages:\n\n- `yeswiki/yeswiki >= 4.6.2, < 4.6.6`\n\nPatched in:\n\n- `yeswiki/yeswiki 4.6.6`\n\nSource: https://github.com/advisories/GHSA-mv28-wj57-f57g","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":8185,"id":"CVE-2026-52767","ts":1788919972965,"field":"exploit_available","old":"false","new":"true"},{"seq":7994,"id":"CVE-2026-52767","ts":1788919275398,"field":"exploit_available","old":"true","new":"false"},{"seq":7803,"id":"CVE-2026-52767","ts":1788916333573,"field":"exploit_available","old":"false","new":"true"},{"seq":7612,"id":"CVE-2026-52767","ts":1788915291640,"field":"exploit_available","old":"true","new":"false"},{"seq":7421,"id":"CVE-2026-52767","ts":1788912694818,"field":"exploit_available","old":"false","new":"true"},{"seq":7230,"id":"CVE-2026-52767","ts":1788911323928,"field":"exploit_available","old":"true","new":"false"},{"seq":7037,"id":"CVE-2026-52767","ts":1788909060887,"field":"exploit_available","old":"false","new":"true"},{"seq":6849,"id":"CVE-2026-52767","ts":1788907385490,"field":"exploit_available","old":"true","new":"false"},{"seq":6651,"id":"CVE-2026-52767","ts":1788905428296,"field":"exploit_available","old":"false","new":"true"},{"seq":6469,"id":"CVE-2026-52767","ts":1788903454627,"field":"exploit_available","old":"true","new":"false"},{"seq":6264,"id":"CVE-2026-52767","ts":1788901797299,"field":"exploit_available","old":"false","new":"true"},{"seq":6094,"id":"CVE-2026-52767","ts":1788899557521,"field":"exploit_available","old":"true","new":"false"},{"seq":5905,"id":"CVE-2026-52767","ts":1788898149113,"field":"exploit_available","old":"false","new":"true"},{"seq":5794,"id":"CVE-2026-52767","ts":1788895705181,"field":"exploit_available","old":"true","new":"false"},{"seq":5783,"id":"CVE-2026-52767","ts":1788894573794,"field":"exploit_available","old":"false","new":"true"}]}