The vulnerability in HedgeDoc allows a note owner to submit permission values that are not part of the supported set, causing the permission checks to fall through to permissive behavior. This can make a note readable or writable by users more broadly than intended, thereby extending authorization beyond the owner’s control. The weakness arises from insufficient input validation, leading to an unauthorized escalation of permission levels.

This issue impacts HedgeDoc installations of versions prior to 1.11.1. It is present in SQLite, MySQL, and PostgreSQL deployments. In SQLite the database column does not enforce the limited set, permitting persistent invalid values. In MySQL or PostgreSQL the database rejects the update but the in-memory state may become inconsistent for connected users until a reload or cache eviction.

The CVSS score is 5.9, indicating moderate severity. No EPSS score is available and the CVE is not listed in KEV. Exploitation requires the note owner to intentionally submit an invalid permission value. Because owners can already set legitimate permissive settings, the practical impact is limited to an owner’s own notes. However, the permissive fallback could expose data to other collaborators if a note owner misconfigures permissions, and the mismatch between in-memory and persisted state may allow unauthorized reading or editing of a note until the affected user reloads the page.