{"id":"CVE-2026-123502","kind":"vulnerability","aliases":["CVE-2026-123502"],"related":[],"title":"Vikunja: request logs expose link-share hashes that grant project access","description":"Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.","summary":"Vikunja's request logger records the raw URI of the share authentication route, so the share hash appears in logs. Anyone who can read those logs can reuse a non-expiring, non-password-protected share hash to obtain a project token with read, write or admin rights.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","project-management","self-hosted","vikunja"],"not_affected_if":["no-link-shares","version-2.7.1-or-later"],"how_to_check":"- Confirm the Vikunja version with `vikunja version` or the release shown in the running instance.\n- Review whether link shares are used and whether they have passwords or expiry set.\n- Check who can read Vikunja and reverse proxy access logs.","fix":"- Vikunja: move to `2.7.1` or later, per the advisory's 'before 2.7.1' range.","status":"open","published_at":"2026-11-08T02:16:38+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:24:44+00:00","updated_at":"2026-11-08T02:24:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:24:44Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later, per the advisory's 'before 2.7.1' range.","reach":"network","title":"Vikunja: request logs expose link-share hashes that grant project access","impact":"high","summary":"Vikunja's request logger records the raw URI of the share authentication route, so the share hash appears in logs. Anyone who can read those logs can reuse a non-expiring, non-password-protected share hash to obtain a project token with read, write or admin rights.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","project-management"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"log readers obtain project tokens with write or admin access","analyst_note":"","how_to_check":"- Confirm the Vikunja version with `vikunja version` or the release shown in the running instance.\n- Review whether link shares are used and whether they have passwords or expiry set.\n- Check who can read Vikunja and reverse proxy access logs.","plain_action":"","needs_analyst":false,"not_affected_if":["no-link-shares","version-2.7.1-or-later"],"who_is_affected":"Self-hosted or managed Vikunja instances before 2.7.1 that use link shares. Exposure requires someone with read access to Vikunja or reverse proxy access logs; instances with no link shares or without log access are less exposed. unknown whether other configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4292,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123502':15A,18A '-2026':14A,17A '/shares':104C '2.7.1':78C 'access':12A,109C,115C 'admin':74B,137C 'allow':85C 'anyon':47B 'appear':44B 'attack':107C 'authent':38B 'contain':79C 'cve':13A,16A 'expir':58B,121C 'expos':4A 'exposur':82C 'grant':10A 'hash':8A,43B,64B,93C,127C 'host':25B 'inform':81C 'jwt':132C 'link':6A,91C 'link-shar':5A,90C 'log':3A,46B,52B,86C,116C 'logger':30B,97C 'manag':22B 'non':57B,60B,120C,123C 'non-expir':56B,119C 'non-password-protect':59B,122C 'obtain':66B,89C,129C 'packag':19B 'password':61B,124C 'permiss':138C 'project':11A,21B,68B,131C 'project-manag':20B 'protect':62B,125C 'proxi':114C 'raw':33B,100C 'read':50B,71B,134C 'reader':87C 'record':31B,98C 'request':2A,29B,96C 'reus':54B,118C 'revers':113C 'right':75B 'rout':39B,106C 'self':24B 'self-host':23B 'share':7A,37B,42B,63B,92C,126C 'share/auth':105C 'token':69B 'uri':34B,101C 'vikunja':1A,26B,27B,76C,111C 'vulner':83C 'write':72B,135C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Vikunja instances before 2.7.1 that use link shares. Exposure requires someone with read access to Vikunja or reverse proxy access logs; instances with no link shares or without log access are less exposed. unknown whether other configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","projectmanagement","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123502':15A,18A '-2026':14A,17A 'access':12A 'cve':13A,16A 'expos':4A 'grant':10A 'hash':8A 'link':6A 'link-shar':5A 'log':3A 'project':11A 'request':2A 'share':7A 'vikunja':1A","search_b":"'admin':74B 'anyon':47B 'appear':44B 'authent':38B 'expir':58B 'hash':43B,64B 'host':25B 'log':46B,52B 'logger':30B 'manag':22B 'non':57B,60B 'non-expir':56B 'non-password-protect':59B 'obtain':66B 'packag':19B 'password':61B 'project':21B,68B 'project-manag':20B 'protect':62B 'raw':33B 'read':50B,71B 'record':31B 'request':29B 'reus':54B 'right':75B 'rout':39B 'self':24B 'self-host':23B 'share':37B,42B,63B 'token':69B 'uri':34B 'vikunja':26B,27B 'write':72B","search_c":"'/shares':104C '2.7.1':78C 'access':109C,115C 'admin':137C 'allow':85C 'attack':107C 'contain':79C 'expir':121C 'exposur':82C 'hash':93C,127C 'inform':81C 'jwt':132C 'link':91C 'link-shar':90C 'log':86C,116C 'logger':97C 'non':120C,123C 'non-expir':119C 'non-password-protect':122C 'obtain':89C,129C 'password':124C 'permiss':138C 'project':131C 'protect':125C 'proxi':114C 'raw':100C 'read':134C 'reader':87C 'record':98C 'request':96C 'reus':118C 'revers':113C 'rout':106C 'share':92C,126C 'share/auth':105C 'uri':101C 'vikunja':76C,111C 'vulner':83C 'write':135C","first_public_at":"2026-10-22T10:01:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123502","severity":null,"published_at":"2026-11-08T02:16:38+00:00","modified_at":"2026-11-08T02:16:38+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99153,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-ff52-3296-2fvr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:01:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99154,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-link-share-hash-exposure-via-request-path-logging","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}