{"id":"CVE-2026-123500","kind":"vulnerability","aliases":["CVE-2026-123500"],"related":[],"title":"Vikunja: dump archives readable by local users expose secrets and files","description":"Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.","summary":"Vikunja's dump command writes its zip archive with permissions that let other local users read it. The archive holds config, password hashes, TOTP secrets, tokens and stored files, so a local attacker on a shared host can take them.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","shared-hosts","vikunja"],"not_affected_if":["dump-never-run","single-user-host"],"how_to_check":"- Run `vikunja --version` and compare against the fixed release.\n- Check the permissions on the dump zip in the Vikunja rootpath with `ls -l` for any dump archive that was created by `vikunja dump`; world-readable means exposed.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:24:45+00:00","updated_at":"2026-11-08T02:24:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:45Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"local","title":"Vikunja: dump archives readable by local users expose secrets and files","impact":"high","summary":"Vikunja's dump command writes its zip archive with permissions that let other local users read it. The archive holds config, password hashes, TOTP secrets, tokens and stored files, so a local attacker on a shared host can take them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","shared-hosts"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local users read secrets, password hashes and stored files","analyst_note":"","how_to_check":"- Run `vikunja --version` and compare against the fixed release.\n- Check the permissions on the dump zip in the Vikunja rootpath with `ls -l` for any dump archive that was created by `vikunja dump`; world-readable means exposed.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-host","dump-never-run"],"who_is_affected":"Only hosts where Vikunja has been run with the dump command and where other local users can log in or reach the rootpath. Servers where Vikunja runs in a container or on a single-user machine carry much less risk. unknown for whether a managed hosting provider is affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4274,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123500':14A,17A '-2026':13A,16A '2.7.1':67C 'allow':75C 'archiv':3A,33B,44B,81C 'attack':58B,92C 'command':29B,90C 'config':46B,109C 'contain':68C 'creat':82C 'cve':12A,15A 'dump':2A,28B,80C,89C 'expos':8A 'file':11A,54B,71C,117C 'hash':48B,111C 'hold':45B 'host':21B,24B,62B,96C 'insecur':70C 'let':37B 'local':6A,39B,57B,76C,91C 'obtain':108C 'packag':18B 'password':47B,110C 'permiss':35B,72C,85C 'read':41B,79C,98C 'readabl':4A,102C 'rootpath':106C 'secret':9A,50B,113C 'self':20B 'self-host':19B 'share':23B,61B,95C 'shared-host':22B 'store':53B,116C 'take':64B 'token':51B,114C 'totp':49B,112C 'umask':84C 'user':7A,40B,77C 'vikunja':1A,25B,26B,65C,88C 'vulner':73C 'world':101C 'world-read':100C 'write':30B 'zip':32B,103C","nicknames":[],"mitigations":[],"who_affected":"Only hosts where Vikunja has been run with the dump command and where other local users can log in or reach the rootpath. Servers where Vikunja runs in a container or on a single-user machine carry much less risk. unknown for whether a managed hosting provider is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","sharedhosts","vikunja"],"campaign_type":null,"search_a":"'-123500':14A,17A '-2026':13A,16A 'archiv':3A 'cve':12A,15A 'dump':2A 'expos':8A 'file':11A 'local':6A 'readabl':4A 'secret':9A 'user':7A 'vikunja':1A","search_b":"'archiv':33B,44B 'attack':58B 'command':29B 'config':46B 'dump':28B 'file':54B 'hash':48B 'hold':45B 'host':21B,24B,62B 'let':37B 'local':39B,57B 'packag':18B 'password':47B 'permiss':35B 'read':41B 'secret':50B 'self':20B 'self-host':19B 'share':23B,61B 'shared-host':22B 'store':53B 'take':64B 'token':51B 'totp':49B 'user':40B 'vikunja':25B,26B 'write':30B 'zip':32B","search_c":"'2.7.1':67C 'allow':75C 'archiv':81C 'attack':92C 'command':90C 'config':109C 'contain':68C 'creat':82C 'dump':80C,89C 'file':71C,117C 'hash':111C 'host':96C 'insecur':70C 'local':76C,91C 'obtain':108C 'password':110C 'permiss':72C,85C 'read':79C,98C 'readabl':102C 'rootpath':106C 'secret':113C 'share':95C 'store':116C 'token':114C 'totp':112C 'umask':84C 'user':77C 'vikunja':65C,88C 'vulner':73C 'world':101C 'world-read':100C 'zip':103C","first_public_at":"2026-10-22T10:00:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123500","severity":null,"published_at":"2026-11-08T02:16:37+00:00","modified_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99149,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp64-xg8g-9mpr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:00:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99150,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insecure-permissions-on-dump-archive-via-vikunja-dump","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}