Read the docs
TI-2026-51085 Aliases CVE-2026-72861GHSA-785c-v4m5-q4wg

Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

Priority LOW 36CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00269 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
appwritetemplatesup to 1.1.2—No fix listedCNA
  • templates Vendorappwrite Affected up to 1.1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72861
  2. 2026-10-03 Alias added: GHSA-785c-v4m5-q4wg

References

Other 5

  • TI-2023-11948 Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via… CVSS 3.1HIGH 7.5
  • TI-2022-09061 The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote… CVSS 3.1HIGH 7.5
  • TI-2023-27861 In Appwrite CLI before 3.0.0, when using the login command, the credentials of the… CVSS 3.1MEDIUM 5.5
  • TI-2021-06180 Prototype pollution in litespeed.js CVSS 3.1CRITICAL 9.8
  • TI-2026-60343 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter CVSS 4.0HIGH 8.7
  • TI-2024-00984 Server-side request forgery in Appwrite CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences