Improper Authorization in HedgeDoc - #VU165817
Published: November 11, 2026
Vulnerability identifier: #VU165817
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read note contents without the intended authorization.
The vulnerability exists due to improper authorization in the checkViewPermission function in lib/web/note/util.js when handling HTTP requests for notes with unsupported permission values stored in the database. A remote attacker can request an affected note over HTTP to retrieve its contents because the permission check treats unrecognized values as publicly readable.
The issue affects instances using SQLite, where unsupported permission values can persist because the database does not enforce strict enum checks.
Affected software
HedgeDoc
Remediation
Install security update from vendor's website.
HedgeDoc - update to 1.12.1