CVE-2026-102927: HedgeDoc: Missing validation of incoming permission values on change
HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HedgeDocto a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Exploitation requires a note owner to intentionally submit an unsupported permission value through the WebSocket permission handler. It does not describe an unauthenticated or arbitrary user changing another user's note permissions.
Are all database deployments affected in the same way?
No. SQLite deployments can persist the invalid permission value because the relevant column does not strictly enforce the supported set. MySQL and PostgreSQL reject the database update, but connected users may still observe inconsistent in-memory note state until the note is reloaded or the cache is evicted.
What is the impact of an invalid permission value?
Permission checks handle recognized values only and may fall through to permissive behavior for unsupported values. This can make a note readable or writable by a broader audience than the owner intended.
What should teams do if they cannot immediately upgrade?
Ensure note owners do not submit permission strings outside freely, editable, limited, locked, protected, and private. On MySQL or PostgreSQL, reload affected notes or evict cached state if an invalid permission update was attempted.
Which version contains the fix?
The issue is fixed in HedgeDoc version 1.11.1. Versions prior to 1.11.1 are affected.