PatchSiren

appwrite CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM appwrite CVE published 2026-08-20

CVE-2026-72861

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition, allowing unauthenticated requests to pass the check. This occurs because verifyWebhook in node/github-issue-bot/src/github.js and node-typescript/github-issue-bot/src/github.ts returns 'typeof signature !== 'string' || (await verify(...))', causing the function to report success without HMA [truncated]