HedgeDoc CVE-2026-58488

Q: What is the CVSS score of CVE-2026-58488?

CVE-2026-58488 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-13 GitHub_M

Authentication Bypass Hedgedoc

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth or complexity required (AV:N/AC:L/PR:N/UI:N); limited integrity impact from mass account creation and limited availability impact from request flooding; no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:31 vuln.today

DescriptionCVE.org

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /register routes by spoofing IP addresses. HedgeDoc instances checked for CloudFlare's cf-connecting-ip header and used that instead of the users real IP address, if the header was present even when the request did not originate from Cloudflare. This made it possible for an attacker to spam login requests or create multiple arbitrary accounts by sending another cf-connecting-ip header every few requests. The issue has been fixed in version 1.11.0.

AnalysisAI

Rate-limiting bypass in HedgeDoc prior to 1.11.0 permits unauthenticated remote attackers to circumvent brute-force protections on the /login and /register endpoints by injecting arbitrary cf-connecting-ip headers, cycling apparent source IPs per request. This enables unlimited credential-stuffing attacks against login and bulk registration of throwaway accounts. No public exploit code identified at time of analysis; the issue is confirmed fixed in version 1.11.0 per the vendor's GitHub Security Advisory.

Technical ContextAI

HedgeDoc is a Node.js-based open-source collaborative markdown note application. The vulnerability is rooted in CWE-290 (Authentication Bypass by Spoofing): the application consumed Cloudflare's cf-connecting-ip header - intended to convey the originating client IP when traffic passes through Cloudflare's proxy network - as the authoritative client IP for rate-limiting purposes without verifying that the request actually transited Cloudflare infrastructure. Because HTTP headers are attacker-controlled, any client could inject a cf-connecting-ip header with an arbitrary value, causing the rate limiter to record a different IP per request and never accumulate enough hits from a single apparent source to trigger a block. The affected CPE is cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:* covering all versions prior to 1.11.0.

RemediationAI

Upgrade HedgeDoc to version 1.11.0 or later, which fixes the issue by gating cf-connecting-ip header trust to requests that can be verified as originating from Cloudflare's infrastructure. The authoritative advisory is at https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v. If immediate upgrade is not possible, configure a reverse proxy (e.g., nginx) upstream of HedgeDoc to unconditionally strip any incoming cf-connecting-ip headers before they reach the application; note that this breaks legitimate IP attribution for deployments genuinely behind Cloudflare, so the header should be re-injected only by a trusted Cloudflare-verified path. As an additional compensating control, disabling public registration eliminates the mass account-creation attack surface entirely, though /login brute-force risk remains. Deploying network-layer rate limiting (WAF, fail2ban on the reverse proxy, or Cloudflare's own rate-limiting rules) upstream of the application provides defense-in-depth against the credential-stuffing risk independently of the application patch.