Webhook Signature Verification Bypass in Appwrite Templates by Appwrite

CVE-2026-72861

What is CVE-2026-72861?

A vulnerability exists in Appwrite Templates' GitHub issue bot due to improper verification of the GitHub webhook signature. The verifyWebhook function's logic incorrectly allows unauthenticated requests without a valid X-Hub-Signature-256 header to succeed. This flaw enables attackers to post unauthorized comments on any repository and issue using the configured GITHUB_TOKEN. By exploiting this vulnerability, an attacker can manipulate the function to execute actions that should otherwise be restricted, posing significant risks to the integrity of the repositories involved.

References