SB20261111147 - Multiple vulnerabilities in HedgeDoc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261111147

SB20261111147 - Multiple vulnerabilities in HedgeDoc

Published: November 11, 2026

Security Bulletin ID SB20261111147
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 17% Low 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by crashing the HedgeDoc server.

The vulnerability exists due to prototype pollution in the historyPost function in lib/history.js when processing note-history updates using an existence check that accepts inherited properties. A remote user can submit a history update with the note alias __proto__ to modify the pinned property on Object.prototype, causing an HTTP 500 response and subsequent requests to crash the Node.js process.


2) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read note contents without the intended authorization.

The vulnerability exists due to improper authorization in the checkViewPermission function in lib/web/note/util.js when handling HTTP requests for notes with unsupported permission values stored in the database. A remote attacker can request an affected note over HTTP to retrieve its contents because the permission check treats unrecognized values as publicly readable.

The issue affects instances using SQLite, where unsupported permission values can persist because the database does not enforce strict enum checks.


3) Information Exposure Through Timing Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to determine whether an email address is registered at a HedgeDoc instance.

The vulnerability exists due to an observable timing discrepancy in the email login process when processing login attempts: unknown email addresses trigger an immediate return, while existing accounts require scrypt password verification. A remote attacker can submit login attempts and compare response times to identify registered email addresses, potentially using many source IP addresses to perform enumeration under the default rate limits.

Only instances with local email login enabled are affected; this is the default configuration, controlled by email or CMD_EMAIL.


4) Improper Restriction of Rendered UI Layers or Frames (CVE-ID: N/A)

CWE-ID: CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to display deceptive, interactive third-party content within a trusted HedgeDoc presentation URL for phishing or user-interface spoofing.

The vulnerability exists due to improper restriction of rendered frames in HedgeDoc's slide presentation rendering when reveal.js dynamically creates background iframes without the sandbox and credentialless attributes. A remote user can author a presentation using data-background-iframe and data-background-interactive attributes and share its link with viewers to display attacker-controlled interactive content within the presentation.


5) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing the HedgeDoc server process.

The vulnerability exists due to an uncaught exception in the WebSocket selection handler in lib/ot/editor-socketio-server.js when processing invalid editor selection ranges. A remote attacker can send specially crafted selection data for a note they can edit to trigger a type error during conversion by Range.fromJSON in lib/ot/selection.js, terminating the Node.js process and making the entire instance temporarily unavailable.


6) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over another user's account.

The vulnerability exists due to authorization bypass through a user-controlled key in HedgeDoc's external identity-provider login handling when looking up accounts using the profileid database column without identifying the issuing provider. A remote user can log in through a second trusted identity provider using an ID matching another user's stored profile ID to take over that user's account.


Remediation

Install update from vendor's website.

References