CVE-2026-58489

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.11.0

Description The GitHub Gist export flow fails to properly validate the OAuth2 state value, checking only for its presence instead of verifying it against the user session. This allows an attacker to forge a callback URL with a valid GitHub OAuth code. If a logged-in user clicks this crafted link, the application uses the victim's session to select a note but the attacker's authorization code to determine the destination account. Consequently, private, protected, or limited notes can be exported directly into a Gist controlled by the attacker.

Recommendations Update to version 1.11.0.