---
id: "CVE-2026-123500"
page: "https://infrastack.ai/live/CVE-2026-123500"
kind: "vulnerability"
aliases: ["CVE-2026-123500"]
title: "Vikunja: dump archives readable by local users expose secrets and files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "shared-hosts", "vikunja"]
not_affected_if: ["dump-never-run", "single-user-host"]
published_at: "2026-11-08T02:16:37+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:24:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123500", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: dump archives readable by local users expose secrets and files

Link for people: https://infrastack.ai/live/CVE-2026-123500 (this .md is for agents)

Vikunja's dump command writes its zip archive with permissions that let other local users read it. The archive holds config, password hashes, TOTP secrets, tokens and stored files, so a local attacker on a shared host can take them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `vikunja --version` and compare against the fixed release.
- Check the permissions on the dump zip in the Vikunja rootpath with `ls -l` for any dump archive that was created by `vikunja dump`; world-readable means exposed.

## Fix

- Vikunja: move to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123500

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp64-xg8g-9mpr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insecure-permissions-on-dump-archive-via-vikunja-dump

## From the sources

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_