HedgeDoc CVE-2026-58488

The target must run HedgeDoc on a version prior to 1.11.0 and must be reachable over a network by the attacker. No authentication is required and no special network position (such as a man-in-the-middle position) is needed - the attacker simply includes an arbitrary cf-connecting-ip HTTP header in standard HTTP requests. The bypass applies specifically to the /login and /register routes where rate-limiting is enforced. Exploitation is limited in direct impact to bypassing rate limits; it does not provide direct code execution, data exfiltration, or privilege escalation on its own. Instances not exposed to the internet or protected by upstream rate-limiting controls (WAF, reverse proxy header stripping) face reduced real-world risk. Public registration being enabled increases severity for the account-creation abuse vector.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N correctly reflects trivial network exploitation with no prerequisites, but the impact sub-scores (VA:L, all others N) understate the practical security consequence for internet-facing deployments. Bypassing login rate-limiting enables unconstrained credential-stuffing, which can lead to full account takeover - an outcome not captured by the raw availability impact label. The mass-registration capability can pollute user databases, enable spam campaigns from the platform, or exhaust storage. The attack requires only the ability to set an HTTP header and is fully automatable, making it trivially scalable. No CISA KEV listing and no known POC code exist at time of analysis, indicating no confirmed in-the-wild exploitation; EPSS data was not available in the provided intelligence. Deployments behind a WAF or reverse proxy that strips untrusted headers upstream are partially mitigated, but the application itself should not be relied upon as a control point. Overall, this is a genuine priority for any internet-exposed HedgeDoc instance with public registration or publicly known accounts.

An attacker scripts HTTP POST requests to a public HedgeDoc instance's /login endpoint, incrementing the cf-connecting-ip header value (e.g., cycling through 1.0.0.1, 1.0.0.2, 1.0.0.3) with each attempt. The application rate limiter records a new unique IP per request and never blocks the attacker's actual source address, permitting thousands of credential-stuffing attempts per minute against known email addresses. The same technique applied to /register allows bulk creation of accounts for spam abuse.