Authorization Issues in HedgeDoc Open Source Collaborative Notes Application

CVE-2026-102927

What is CVE-2026-102927?

HedgeDoc, a widely-used open-source collaborative markdown notes application, has a vulnerability in its WebSocket permission handler that could allow note owners to set improper permission values beyond the defined limits. This issue arises primarily when a note owner submits an invalid permission string, leading to unauthorized access levels for other users. In SQLite implementations, this could result in inconsistent permission enforcement, while MySQL and PostgreSQL databases might deny the update but can result in misleading in-memory states for connected users until a reload is initiated. This vulnerability was addressed in HedgeDoc version 1.11.1, which ensures stricter validation of permission values.

References