CVE-2026-123505 · Runtime
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 creates storage blobs with world-readable file permissions. A local user on the same machine can read attachments, project backgrounds, exports and the SQLite database, then crack password hashes offline.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja on a shared host or any machine where other local users have accounts. Exposure comes from the file permissions Vikunja sets on its stored blobs and database, so a managed instance where only the vendor controls the host is less exposed. Hosts with only one trusted user can deprioritise it.
Not affected if managed-hosting, single-user-host
Who cares self-hosted, vikunja
vikunja version or the release tag in your deploymentls -l and confirm they are not world-readable2.7.1 or laterVikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.