CVE-2026-123512 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja puts live password-reset, email-confirmation and account-deletion tokens in the query string of emailed links. Anyone who can read the HTTP access log or reverse-proxy log can replay an unused reset token to take over the account, or a deletion token to confirm deletion.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Vikunja instances before 2.7.1 are exposed, because the tokens are written to the access log and any reverse-proxy log whenever a user clicks an emailed link. Anyone with read access to those logs can use an unredeemed token. Hosted services run by others, and instances already on 2.7.1 or later, are not affected by this flaw.
Not affected if managed-hosting, version-2.7.1-or-later
Who cares reverse-proxy-logs, self-hosted, vikunja
vikunja version or the running image tag; affected builds are those before 2.7.1.2.7.1 or later.Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.