CVE-2023-38487

HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one. When the freeURL feature is enabled (by setting the `allowFreeURL` config option or the `CMD_ALLOW_FREEURL` environment variable to `true`), any user with the appropriate permissions can create a note by making a POST request to the `/new/<ALIAS>` API endpoint. The `<ALIAS>` parameter can be set to the ID of an existing note. HedgeDoc did not verify whether the provided `<ALIAS>` value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed. Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note. Attackers could use this issue to present a manipulated copy of the original note to the user, e.g. by replacing the links with malicious ones. Attackers can also use this issue to prevent access to the original note, causing a denial of service. No data is lost, as the original content of the affected notes is still present in the database. This issue was fixed in version 1.9.9. As a workaround, disabling freeURL mode prevents the exploitation of this issue. The impact can be limited by restricting freeURL note creation to trusted, logged-in users by enabling `requireFreeURLAuthentication`/`CMD_REQUIRE_FREEURL_AUTHENTICATION`.

• CWE-289

• https://github.com/hedgedoc/hedgedoc/pull/4476/commits/781263ab84255885e1fe60c7e92e2f8d611664d2Patch
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-7494-7hcf-vxpgExploit, Patch, Vendor Advisory
• https://github.com/hedgedoc/hedgedoc/pull/4476/commits/781263ab84255885e1fe60c7e92e2f8d611664d2Patch
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-7494-7hcf-vxpgExploit, Patch, Vendor Advisory

Published

Aug 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38481URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2023-38482Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-38483Missing Authorization vulnerability in Dylan Blokhuis Instan…5.4
• CVE-2023-38484Vulnerabilities exist in the BIOS implementation of Aruba 92…6.4
• CVE-2023-38485Vulnerabilities exist in the BIOS implementation of Aruba 92…6.4
• CVE-2023-38486A vulnerability in the secure boot implementation on affecte…6.4
• CVE-2023-38488Kirby is a content management system. A vulnerability in ver…8.8
• CVE-2023-38489Kirby is a content management system. A vulnerability in ver…7.3
• CVE-2023-3849A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2023-38490Kirby is a content management system. A vulnerability in ver…10
• CVE-2023-38491Kirby is a content management system. A vulnerability in ver…5.4
• CVE-2023-38492Kirby is a content management system. A vulnerability in ver…7.5