CVE-2026-123502 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja's request logger records the raw URI of the share authentication route, so the share hash appears in logs. Anyone who can read those logs can reuse a non-expiring, non-password-protected share hash to obtain a project token with read, write or admin rights.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted or managed Vikunja instances before 2.7.1 that use link shares. Exposure requires someone with read access to Vikunja or reverse proxy access logs; instances with no link shares or without log access are less exposed. unknown whether other configurations are affected.
Not affected if no-link-shares, version-2.7.1-or-later
Who cares project-management, self-hosted, vikunja
vikunja version or the release shown in the running instance.2.7.1 or later, per the advisory's 'before 2.7.1' range.Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.