HedgeDoc up to 1.10.x Login/Registration cf-connecting-ip improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in HedgeDoc up to 1.10.x. This vulnerability affects unknown code of the component Login/Registration. Performing a manipulation of the argument cf-connecting-ip results in improper authentication. This vulnerability was named CVE-2026-58488. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in HedgeDoc up to 1.10.x. This affects an unknown functionality of the component Login/Registration. The manipulation of the argument cf-connecting-ip with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on integrity, and availability. The summary by CVE is:

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /register routes by spoofing IP addresses. HedgeDoc instances checked for CloudFlare's cf-connecting-ip header and used that instead of the users real IP address, if the header was present even when the request did not originate from Cloudflare. This made it possible for an attacker to spam login requests or create multiple arbitrary accounts by sending another cf-connecting-ip header every few requests. The issue has been fixed in version 1.11.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-58488 since 06/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.11.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• HedgeDoc

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10

Website

• Product: https://github.com/hedgedoc/hedgedoc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion