HedgeDoc’s GitHub Gist export used an OAuth2 state token that was only checked for presence, not for correctness. This allowed an attacker to forge a callback URL with a valid GitHub authorization code. When a logged‑in user clicked the crafted link, HedgeDoc exported the user’s private note to an attacker‑controlled Gist using the attacker’s OAuth code. The flaw is a classic Cross‑Site Request Forgery (CWE-352) that leaks private data.

Vulnerable versions of HedgeDoc before 1.11.0. The issue affects all deployments of the hedgedoc:hedgedoc product running an older release. Users who keep the application at a pre‑1.11.0 version are at risk.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is browser‑initiated HTTP requests: an attacker only needs to entice a logged‑in user to click a malicious link. No authentication or privilege escalation beyond the victim’s logged‑in session is required.