Cross-site request forgery in HedgeDoc - CVE-2026-58489
Published: November 11, 2026
Vulnerability details
The vulnerability allows a remote user to disclose private, protected, or limited note content by causing it to be exported to an attacker-controlled GitHub Gist.
The vulnerability exists due to missing OAuth2 state validation in the GitHub Gist export callback when processing GitHub authorization responses. A remote user can trick a logged-in victim into clicking a forged callback URL containing the user's own valid GitHub authorization code and a state parameter that is present but does not match the expected value to export a note accessible through the victim's session to a GitHub Gist controlled by that user.
Exploitation requires GitHub Gist export to be enabled with a GitHub clientID and clientSecret configured.