CVE-2026-102927

HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1.

• CWE-20
• CWE-284

• https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102916A reachable assertion in the illumos bhyve instruction emula…6.8
• CVE-2026-102917IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticat…7.8
• CVE-2026-102918The Redux Framework plugin for WordPress is vulnerable to St…6.4
• CVE-2026-10292A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3…8.8
• CVE-2026-102923SparkyFitness is a self-hosted, AI-powered health and fitnes…5.4
• CVE-2026-102925virtualenv is a tool for creating isolated virtual python en…7.8
• CVE-2026-10293A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306…8.8
• CVE-2026-102930virtualenv is a tool for creating isolated virtual python en…7.7
• CVE-2026-102937virtualenv is a tool for creating isolated virtual python en…7.3
• CVE-2026-102938virtualenv is a tool for creating isolated virtual python en…5.8
• CVE-2026-10294A vulnerability has been found in PackageKit up to 1.3.5. Af…4.3
• CVE-2026-102941The package github.com/gomarkdown/markdown is a Go library f…7.5