{"id":"CVE-2026-102927","kind":"vulnerability","aliases":["CVE-2026-102927"],"related":[],"title":"HedgeDoc: invalid note permission values can widen who reads or edits","description":"HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1.","summary":"HedgeDoc's WebSocket permission handler accepts permission strings outside its allowed set, and the viewing and editing checks fall through to permissive behavior for them. A note owner can make a note readable or writable more broadly than intended, and on SQLite the invalid value persists.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hedgedoc","package","self-hosted","sqlite"],"not_affected_if":["hedgedoc-1.11.1-or-later"],"how_to_check":"- Check the HedgeDoc version in use; affected versions are those before `1.11.1`.\n- Check the database engine in use; SQLite deployments can persist the invalid value.","fix":"- HedgeDoc: upgrade to `1.11.1`.","status":"open","published_at":"2026-11-05T18:16:59+00:00","first_seen_at":"2026-11-05T18:40:08+00:00","triaged_at":"2026-11-05T18:40:40+00:00","updated_at":"2026-11-05T18:40:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T18:40:40Z","model":"claude-haiku-5-5","output":{"fix":"- HedgeDoc: upgrade to `1.11.1`.","reach":"internet","title":"HedgeDoc: invalid note permission values can widen who reads or edits","impact":"low","summary":"HedgeDoc's WebSocket permission handler accepts permission strings outside its allowed set, and the viewing and editing checks fall through to permissive behavior for them. A note owner can make a note readable or writable more broadly than intended, and on SQLite the invalid value persists.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hedgedoc","self-hosted","sqlite"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Notes become readable or writable by users who should not have access.","analyst_note":"","how_to_check":"- Check the HedgeDoc version in use; affected versions are those before `1.11.1`.\n- Check the database engine in use; SQLite deployments can persist the invalid value.","plain_action":"","needs_analyst":false,"not_affected_if":["hedgedoc-1.11.1-or-later"],"who_is_affected":"Teams that self-host HedgeDoc before version 1.11.1. The flaw needs a note owner to submit an invalid permission value on purpose, and the owner could already pick a legitimate permissive setting, so practical impact is limited. Hosted or managed HedgeDoc instances are not covered by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4434,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102927':14A,17A '-2026':13A,16A '1.11.1':84C,212C 'accept':29B 'allow':34B,89C 'alreadi':194C 'applic':81C 'behavior':46B,124C 'broad':60B,132C 'cach':176C 'check':41B,112C 'choos':195C 'collabor':78C 'column':145C 'connect':171C 'could':193C 'cve':12A,15A 'databas':144C,158C 'deploy':136C 'edit':11A,40B,100C,111C 'enforc':149C 'evict':177C 'exploit':178C 'fall':42B,120C 'fix':209C 'freeli':99C 'handl':113C 'handler':28B,88C 'hedgedoc':1A,18B,24B,70C 'host':22B 'impact':205C 'in-memori':164C 'inconsist':169C 'intend':62B,134C 'intent':184C 'invalid':2A,67B,140C,187C 'issu':207C 'known':115C 'leav':162C 'legitim':197C 'limit':101C,201C 'lock':102C 'make':53B,125C 'markdown':79C 'memori':166C 'mysql':153C 'note':3A,50B,55B,80C,91C,127C,167C,181C 'open':73C 'otherwis':119C 'outsid':32B,96C 'owner':51B,92C,182C,192C 'packag':19B 'permiss':4A,27B,30B,45B,87C,106C,123C,188C,198C 'persist':69B,138C 'postgresql':155C 'practic':203C 'prior':82C 'privat':105C 'protect':103C 'read':9A 'readabl':56B,128C 'real':76C 'real-tim':75C 'reject':156C 'reload':174C 'requir':179C 'secur':204C 'self':21B 'self-host':20B 'set':35B,151C,199C 'sourc':74C 'sqlite':23B,65B,135C 'state':168C 'store':94C 'strict':148C 'string':31B,95C 'submit':185C 'support':98C 'time':77C 'updat':159C 'user':172C 'valu':5A,68B,107C,116C,141C,189C 'version':211C 'view':38B,109C 'websocket':26B,86C 'widen':7A 'writabl':58B,130C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host HedgeDoc before version 1.11.1. The flaw needs a note owner to submit an invalid permission value on purpose, and the owner could already pick a legitimate permissive setting, so practical impact is limited. Hosted or managed HedgeDoc instances are not covered by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hedgedoc","medium","package","selfhosted","sqlite"],"campaign_type":null,"first_public_at":"2026-07-24T19:47:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102927","severity":null,"published_at":"2026-11-05T18:16:59+00:00","modified_at":"2026-11-05T18:16:59+00:00","first_seen_at":"2026-11-05T18:40:08+00:00","fetched_at":"2026-11-05T18:40:08+00:00","note":null}],"documents":[{"id":78676,"url":"https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78677,"url":"https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78678,"url":"https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-24T19:47:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}