Reliance on Untrusted Inputs in a Security Decision in HedgeDoc - CVE-2026-58488
Published: November 11, 2026
Vulnerability identifier: #VU165811
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58488
CWE-ID: CWE-807
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass rate limits on login and registration requests, enabling repeated login attempts and unrestricted account creation.
The vulnerability exists due to reliance on an untrusted HTTP header for client identification in HedgeDoc's rate-limiting logic when handling requests to /login and /register. A remote attacker can send requests with changing cf-connecting-ip header values, which are trusted even when requests do not originate from Cloudflare, to bypass per-IP rate limits and submit excessive login or registration requests.
Affected software
HedgeDoc
How to mitigate CVE-2026-58488
Install security update from vendor's website.
HedgeDoc - update to 1.11.0