HedgeDoc Permission Bypass via Invalid WebSocket Values

Executive Summary

HedgeDoc is a collaborative markdown notes application. This vulnerability (CVE-2026-102927) exists in versions before 1.11.1 where the WebSocket permission handler fails to validate permission values properly. Note owners could submit invalid permission strings, bypassing intended access controls and making notes more readable or writable than intended. The issue arises because the system only checks for known permission values but allows unknown values to fall through to permissive behavior.

The vulnerability is limited in practice because only note owners can exploit it, and they already have full access to their notes. The fix in version 1.11.1 adds validation to reject invalid permission values and ensures only allowed values (private, limited, protected, freely, editable, locked) are processed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check HedgeDoc version with: npm list hedgedoc or docker inspect <container>. If version is 1.11.0 or earlier, the system is vulnerable. Review WebSocket permission logs for invalid permission values like non-standard strings.

Useful 0 Not Useful 0

Impact Analysis

The impact is minimal for most users because only note owners can exploit this vulnerability, and they already have full access to their notes. An attacker would need to be a note owner to intentionally set an invalid permission value, which would not provide additional privileges beyond what they already have.

In rare cases, if a note owner sets an invalid permission value, it could make a note more broadly readable or writable than intended, potentially exposing sensitive content to unintended users. SQLite deployments may persist invalid values, while MySQL and PostgreSQL reject updates but may leave in-memory states inconsistent until reload or cache eviction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if it leads to unauthorized access or disclosure of sensitive data. If invalid permissions cause notes containing personal or health data to become more broadly accessible than intended, it may violate data protection requirements for confidentiality and access controls.

However, the practical risk is low because exploitation requires the note owner to intentionally set an invalid permission, which they could already do with valid permissive settings. Upgrading to version 1.11.1 or later mitigates this issue by enforcing strict permission validation.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade HedgeDoc to version 1.11.1 or later immediately. For SQLite deployments, manually validate database entries to remove invalid permission values. Restart the application to clear in-memory inconsistencies.

Useful 0 Not Useful 0