CVE-2026-58489 Details
Description
HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value but only checked that it was present rather than validating it against the value expected for the user's session. Because the state was not properly validated, an attacker could forge a callback URL containing their own valid GitHub OAuth code. When processing the callback, HedgeDoc used the victim's logged-in session to select which note to export, but the attacker's authorization code to determine which GitHub account received it. As a result, a logged-in victim who clicked a crafted link could export their own private, protected, or limited note directly into a Gist controlled by the attacker. This issue has been fixed in version 1.11.0.
A vulnerability in HedgeDoc's GitHub Gist export feature prior to version 1.11.0 allowed attackers to exploit missing validation of the OAuth2 state parameter. This flaw could be used to export private notes from a victim's account to a Gist controlled by the attacker. The issue arose because the application only checked for the presence of the state value, not its validity, enabling the use of forged callback URLs with valid GitHub OAuth codes. When the callback was processed, HedgeDoc used the victim's session to determine which note to export, but the attacker's authorization code to decide which GitHub account received it. This exploitation could result in unauthorized access to private, protected, or limited notes.
Users can upgrade to HedgeDoc version 1.11.0 or later, where this vulnerability has been fixed. If an upgrade is not possible, GitHub OAuth2 can be disabled in the application configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hedgedoc/hedgedoc/commit/fbd7307f162754212046ec343cbe691223a48c8d | [email protected] | Source CodeVendor |
| https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8v9p-5j95-826j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HedgeDoc | <= 1.10.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |