CVE-2023-38487
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
HedgeDoc prior to version 1.9.9 allowed the creation of notes with an alias matching the ID of existing notes, effectively hiding the original notes. Users could exploit this vulnerability to manipulate note content and prevent access to original notes.
Risk Assessment
This vulnerability could lead to fraud, where users may be misled by modified notes, as well as denial of service by blocking access to original content. All users, including those not logged in, are potentially at risk.
Recommendation
It is recommended to upgrade to version 1.9.9 or disable the freeURL mode to prevent exploitation of this issue. Additionally, restricting freeURL note creation to trusted, logged-in users is advisable.
Other vulnerabilities in HedgeDoc
See all- CVE-2026-58489Medium
In HedgeDoc prior to version 1.11.0, the GitHub Gist export flow had an OAuth2 state validation flaw. The state parameter was only checked for presence, not validated against the user's session, allowing an attacker to forge a callback URL. A logged-in victim clicking a crafted link could export their private note to an attacker-controlled Gist.
- CVE-2026-58486High
HedgeDoc before version 1.11.0 was vulnerable to a YAML alias bomb in note frontmatter. Unsafe parsing with js-yaml.load expanded YAML anchor aliases, creating huge object structures and excessive CPU consumption. An attack could block the Node.js event loop for about 235 seconds per request, causing denial of service (DoS).
- CVE-2026-58488Medium
HedgeDoc versions prior to 1.11.0 allowed attackers to bypass rate-limiting on /login and /register routes by spoofing the cf-connecting-ip header. The application trusted this header even when the request did not originate from Cloudflare, enabling login spam or mass account creation.
- CVE-2026-58487Medium
HedgeDoc before version 1.11.0 was vulnerable to stored HTML Injection due to unsafe handling of the local-part of registered email addresses. An attacker could register a specially crafted email address and inject arbitrary HTML into pages viewed by other users.
Original NVD description (English source)
HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one. When the freeURL feature is enabled (by setting the `allowFreeURL` config option or the `CMD_ALLOW_FREEURL` environment variable to `true`), any user with the appropriate permissions can create a note by making a POST request to the `/new/<ALIAS>` API endpoint. The `<ALIAS>` parameter can be set to the ID of an existing note. HedgeDoc did not verify whether the provided `<ALIAS>` value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed. Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note. Attackers could use this issue to present a manipulated copy of the original note to the user, e.g. by replacing the links with malicious ones. Attackers can also use this issue to prevent access to the original note, causing a denial of service. No data is lost, as the original content of the affected notes is still present in the database. This issue was fixed in version 1.9.9. As a workaround, disabling freeURL mode prevents the exploitation of this issue. The impact can be limited by restricting freeURL note creation to trusted, logged-in users by enabling `requireFreeURLAuthentication`/`CMD_REQUIRE_FREEURL_AUTHENTICATION`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS