CVE-2026-123500 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja's dump command writes its zip archive with permissions that let other local users read it. The archive holds config, password hashes, TOTP secrets, tokens and stored files, so a local attacker on a shared host can take them.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only hosts where Vikunja has been run with the dump command and where other local users can log in or reach the rootpath. Servers where Vikunja runs in a container or on a single-user machine carry much less risk. unknown for whether a managed hosting provider is affected.
Not affected if dump-never-run, single-user-host
Who cares self-hosted, shared-hosts, vikunja
vikunja --version and compare against the fixed release.ls -l for any dump archive that was created by vikunja dump; world-readable means exposed.2.7.1 or later.Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.