The critical thing to understand about CVE-2026-72861 is that it's not merely an authentication bypass — it's an authentication bypass that hands the attacker your GitHub API token with whatever scope it carries. The inverted logic in the webhook signature verification (typeof signature !== 'string' evaluates to true when signature is undefined, causing the HMAC check to be skipped entirely) is the mechanism, but the real failure is architectural: the verify function returns a falsy value rather than throwing an exception, so the request processing continues silently with full GitHub API access.
If your Appwrite deployment uses a token with repo scope — which any functioning GitHub issue-bot integration requires — an attacker can comment on private repositories visible to that token, enumerate internal issues, and use the comment text's interpolation of the issue author's login for targeted social engineering. Even after you rotate the token, the historical comments remain as artifacts that can credential future phishing attempts.
The vulnerability exists in both the JavaScript and TypeScript template implementations, indicating copy-paste propagation without security review. This pattern has appeared before: CVE-2022-2884 (GitLab) and CVE-2023-26150 (another GitHub webhook handler) used identical inverted-logic signature verification. The lesson hasn't propagated into template authoring workflows.
Your immediate actions: First, verify whether any Appwrite function deployments use the GitHub webhook template — check your function code for the verifyWebhook pattern. Second, if you find it, audit the GITHUB_TOKEN's permissions: if it has repo scope, treat the exposure as 'attacker has read/write access to your private repositories.' Third, hard-fail on missing signature headers rather than relying on permissive return values — the fix is ensuring verifyWebhook throws an exception when the signature header is absent, not returning a falsy value. Finally, establish a template hash registry to track which versions you deployed; Appwrite's distribution system doesn't notify you of upstream advisories for pinned versions, so you need your own inventory.