CVE-2026-72861 appwrite CVE debrief

Who should care

Users of appwrite/templates who rely on GitHub webhook signature verification for authentication and authorization should verify the implementation of verifyWebhook in their deployments. Specifically, they should ensure that the function correctly handles the X-Hub-Signature-256 header and performs HMAC verification as expected. Additionally, operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential for unauthenticated requests to manipulate the deployed function for arbitrary comment posting. They should review the current configuration of GITHUB_TOKEN permissions and assess the risk of exploitation in their environments. Security teams should also monitor for suspicious activity related to GitHub webhook interactions and implement compensating controls as necessary to mitigate potential impacts. This includes restricting token permissions to the minimum required for the function's intended operation and enhancing monitoring and detection capabilities for exposed assets. Asset inventory and change management processes should be reviewed to ensure that any affected deployments are identified and remediated promptly. Finally, rollback and change window procedures should be assessed to minimize potential downtime in case of remediation efforts. Source tracking and logging mechanisms should be enhanced to detect and respond to potential exploitation attempts effectively. This multi-faceted approach will help mitigate the risk associated with this vulnerability and ensure the security of deployments using appwrite/templates with GitHub webhook integration. To further enhance security, consider implementing additional defensive measures such as regular security audits, penetration testing, and employee training on secure webhook configuration and management. By taking these steps, organizations can reduce the likelihood of successful exploitation and minimize potential impacts on their operations. It is also recommended to stay informed about any updates or patches released by the vendor and to apply them promptly to prevent exploitation. Overall, a comprehensive and proactive approach to security is key.

Technical summary

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns 'typeof signature !== 'string' || (await verify(...))', so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check.

Defensive priority

Authenticated attackers can direct a deployed function to post a comment on an arbitrary repository and issue using a configured GITHUB_TOKEN. Verify webhook signature validation, restrict token permissions, and monitor for suspicious activity.

Recommended defensive actions

• Verify webhook signature validation
• Restrict token permissions
• Monitor for suspicious activity
• Perform inventory checks
• Implement compensating controls

Evidence notes

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns 'typeof signature !== 'string' || (await verify(...))', so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification.

Official resources