Executive brief
The Appwrite github-issue-bot template function is designed to automatically post comments on GitHub issues in response to webhook events. However, a logic error in the webhook signature verification allows attackers to send forged webhook requests without a valid HMAC signature. An attacker can exploit this to post comments on any repository and issue using the function's GitHub credentials, potentially for spam, harassment, or malicious content injection.
Technical details
The verifyWebhook function in both node/github-issue-bot/src/github.js and node-typescript/github-issue-bot/src/github.ts contains an inverted boolean logic error: it returns "typeof signature !== 'string' || (await verify(...))" instead of the correct logic with AND. When the X-Hub-Signature-256 header is missing, the first operand evaluates to true, causing the OR expression to short-circuit and return true without performing HMAC verification. The main.js entry point only rejects requests when verifyWebhook returns false, so unauthenticated requests with no signature header pass validation. An attacker can then craft a request with arbitrary repository and issue objects in the body, causing the function to post comments using the configured GITHUB_TOKEN with no authentication required. The attack requires network access to the deployed function endpoint but no prior authentication or user interaction.
Affected products
- Appwrite Templates prior to fix (github-issue-bot template)
Timeline
- 2026-08-20: disclosed
- other: CVE-2026-72861 assigned