CVE-2026-72861: Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUBTOKEN, with the issue author login from the body interpolated into the comment text.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployed github-issue-bot functions using either the Node or Node TypeScript implementation are exposed if they accept webhook requests and use a configured GITHUB_TOKEN. The affected verification logic is in node/github-issue-bot/src/github.js and node-typescript/github-issue-bot/src/github.ts.
What does an attacker need to send?
An attacker can send an unauthenticated request without an X-Hub-Signature-256 header. They can supply repository and issue objects in the request body, along with an issue-author login that is included in the posted comment text.
What is the practical impact of exploitation?
The function can post a comment using its configured GITHUB_TOKEN on a repository and issue selected through the request body. The scope of reachable repositories and issues depends on the permissions available to that token.