Input validation error in HedgeDoc - CVE-2026-102927

Vulnerability details

The vulnerability allows a remote user to make notes readable and writable more broadly than intended.

The vulnerability exists due to improper input validation in the HedgeDoc WebSocket permission handler when processing note permission updates. A remote user can intentionally submit an invalid permission string for a note they own to cause viewing and editing checks to fall back to permissive behavior.

On SQLite-backed deployments, invalid permission values can persist in the database. On MySQL and PostgreSQL, the database rejects the update, but the in-memory note state can remain inconsistent for connected users until the note is reloaded or evicted from cache.

Affected software

How to mitigate CVE-2026-102927

External References

• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg
• https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b

Related Security Bulletins

• Input validation error in HedgeDoc