---
id: "CVE-2026-123502"
page: "https://infrastack.ai/live/CVE-2026-123502"
kind: "vulnerability"
aliases: ["CVE-2026-123502"]
title: "Vikunja: request logs expose link-share hashes that grant project access"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "project-management", "self-hosted", "vikunja"]
not_affected_if: ["no-link-shares", "version-2.7.1-or-later"]
published_at: "2026-11-08T02:16:38+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:24:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123502", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: request logs expose link-share hashes that grant project access

Link for people: https://infrastack.ai/live/CVE-2026-123502 (this .md is for agents)

Vikunja's request logger records the raw URI of the share authentication route, so the share hash appears in logs. Anyone who can read those logs can reuse a non-expiring, non-password-protected share hash to obtain a project token with read, write or admin rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Vikunja version with `vikunja version` or the release shown in the running instance.
- Review whether link shares are used and whether they have passwords or expiry set.
- Check who can read Vikunja and reverse proxy access logs.

## Fix

- Vikunja: move to `2.7.1` or later, per the advisory's 'before 2.7.1' range.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123502

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-ff52-3296-2fvr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-link-share-hash-exposure-via-request-path-logging

## From the sources

Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_