SB20261111146 - Input validation error in HedgeDoc

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2026-102927)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to make notes readable and writable more broadly than intended.

The vulnerability exists due to improper input validation in the HedgeDoc WebSocket permission handler when processing note permission updates. A remote user can intentionally submit an invalid permission string for a note they own to cause viewing and editing checks to fall back to permissive behavior.

On SQLite-backed deployments, invalid permission values can persist in the database. On MySQL and PostgreSQL, the database rejects the update, but the in-memory note state can remain inconsistent for connected users until the note is reloaded or evicted from cache.

Remediation

Install update from vendor's website.

References

• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg
• https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b