CVE-2026-72861

Name of the Vulnerable Software and Affected Versions appwrite/templates (affected versions not specified)

Description The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The verifyWebhook() function in node/github-issue-bot/src/github.js and node-typescript/github-issue-bot/src/github.ts uses an inverted condition that returns true if the X-Hub-Signature-256 header is missing. This allows unauthenticated requests without a signature to bypass HMAC verification. Consequently, the postComment() function can be triggered using data from the request body, enabling an attacker to use the configured GITHUB TOKEN to post comments on arbitrary repositories and issues by manipulating the repository and issue objects, as well as the issue author login.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.