CVE-2026-72861: Improper Verification of Cryptographic Signature in appwrite templates
Description
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.
CVSS v3.1
Score 5.8medium
Affected software
appwrite
templates
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the verifyWebhook function in appwrite/templates' github-issue-bot code, which uses a logical OR condition that short-circuits when the X-Hub-Signature-256 header is missing. This results in the function returning success without performing HMAC verification. Consequently, unauthenticated requests without a signature bypass the check and can invoke postComment with attacker-controlled repository and issue data, leveraging the configured GITHUB_TOKEN to post comments on arbitrary GitHub issues.
Potential Impact
An attacker can send unauthenticated requests that bypass signature verification and cause the deployed function to post comments on arbitrary GitHub repositories and issues using the configured GITHUB_TOKEN. This leads to unauthorized issue comment injection, which can be used for misinformation, spam, or social engineering within affected repositories. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid deploying or using the vulnerable github-issue-bot templates or implement additional verification controls to ensure webhook authenticity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T15:16:31.372Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a875b0cacd9273b49100d06
Added to database: 08/20/2026, 19:52:44 UTC
Last enriched: 09/25/2026, 02:40:02 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.