CVE-2026-58489
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In HedgeDoc prior to version 1.11.0, the GitHub Gist export flow had an OAuth2 state validation flaw. The state parameter was only checked for presence, not validated against the user's session, allowing an attacker to forge a callback URL. A logged-in victim clicking a crafted link could export their private note to an attacker-controlled Gist.
Risk Assessment
The risk is unauthorized disclosure of sensitive notes (private, protected, or limited) to an external repository controlled by the attacker, without the user's knowledge or consent.
Recommendation
Upgrade HedgeDoc to version 1.11.0 or later immediately, which fixes the OAuth2 state validation issue.
Other vulnerabilities in HedgeDoc
See all- CVE-2026-58486High
HedgeDoc before version 1.11.0 was vulnerable to a YAML alias bomb in note frontmatter. Unsafe parsing with js-yaml.load expanded YAML anchor aliases, creating huge object structures and excessive CPU consumption. An attack could block the Node.js event loop for about 235 seconds per request, causing denial of service (DoS).
- CVE-2026-58488Medium
HedgeDoc versions prior to 1.11.0 allowed attackers to bypass rate-limiting on /login and /register routes by spoofing the cf-connecting-ip header. The application trusted this header even when the request did not originate from Cloudflare, enabling login spam or mass account creation.
- CVE-2026-58487Medium
HedgeDoc before version 1.11.0 was vulnerable to stored HTML Injection due to unsafe handling of the local-part of registered email addresses. An attacker could register a specially crafted email address and inject arbitrary HTML into pages viewed by other users.
- CVE-2023-38487Medium
HedgeDoc prior to version 1.9.9 allowed the creation of notes with an alias matching the ID of existing notes, effectively hiding the original notes. Users could exploit this vulnerability to manipulate note content and prevent access to original notes.
Original NVD description (English source)
HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value but only checked that it was present rather than validating it against the value expected for the user's session. Because the state was not properly validated, an attacker could forge a callback URL containing their own valid GitHub OAuth code. When processing the callback, HedgeDoc used the victim's logged-in session to select which note to export, but the attacker's authorization code to determine which GitHub account received it. As a result, a logged-in victim who clicked a crafted link could export their own private, protected, or limited note directly into a Gist controlled by the attacker. This issue has been fixed in version 1.11.0.