{"id":"CVE-2026-123512","kind":"vulnerability","aliases":["CVE-2026-123512"],"related":[],"title":"Vikunja: emailed reset and deletion tokens leak into access logs","description":"Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.","summary":"Vikunja puts live password-reset, email-confirmation and account-deletion tokens in the query string of emailed links. Anyone who can read the HTTP access log or reverse-proxy log can replay an unused reset token to take over the account, or a deletion token to confirm deletion.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","reverse-proxy-logs","self-hosted","vikunja"],"not_affected_if":["managed-hosting","version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version with `vikunja version` or the running image tag; affected builds are those before `2.7.1`.\n- Search web server and reverse-proxy logs for requests to password-reset, confirm-email or account-deletion paths that include a token in the query string.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:23:12+00:00","updated_at":"2026-11-08T02:23:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:12Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"local","title":"Vikunja: emailed reset and deletion tokens leak into access logs","impact":"high","summary":"Vikunja puts live password-reset, email-confirmation and account-deletion tokens in the query string of emailed links. Anyone who can read the HTTP access log or reverse-proxy log can replay an unused reset token to take over the account, or a deletion token to confirm deletion.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","reverse-proxy-logs"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over accounts via leaked reset tokens","analyst_note":"","how_to_check":"- Check the Vikunja version with `vikunja version` or the running image tag; affected builds are those before `2.7.1`.\n- Search web server and reverse-proxy logs for requests to password-reset, confirm-email or account-deletion paths that include a token in the query string.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-2.7.1-or-later"],"who_is_affected":"Self-hosted Vikunja instances before 2.7.1 are exposed, because the tokens are written to the access log and any reverse-proxy log whenever a user clicks an emailed link. Anyone with read access to those logs can use an unredeemed token. Hosted services run by others, and instances already on 2.7.1 or later, are not affected by this flaw.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4311,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123512':13A,16A '-2026':12A,15A '2.7.1':80C 'access':9A,53B,116C,133C 'account':37B,70B,91C,149C,153C 'account-delet':36B,90C,152C 'anyon':47B 'attack':130C 'click':127C 'confirm':34B,76B,88C,157C 'cve':11A,14A 'delet':5A,38B,73B,77B,92C,154C,159C 'email':2A,33B,45B,87C,100C 'email-confirm':32B,86C 'emb':81C 'full':104C 'host':24B 'http':52B,115C 'includ':107C 'leak':7A 'link':46B,101C,129C 'live':28B,82C 'log':10A,21B,54B,59B,117C,123C,136C 'packag':17B 'password':30B,84C,142C 'password-reset':29B,83C,141C 'proxi':20B,58B,122C 'put':27B 'queri':42B,97C 'read':50B,132C 'replay':61B,138C 'request':105C 'reset':3A,31B,64B,85C,143C 'revers':19B,57B,121C 'reverse-proxi':56B,120C 'reverse-proxy-log':18B 'self':23B 'self-host':22B 'string':43B,98C 'take':67B,146C 'token':6A,39B,65B,74B,93C,109C,144C,155C 'unredeem':140C 'unus':63B 'uri':106C 'url':96C 'user':126C 'vikunja':1A,25B,26B,78C,113C 'written':111C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vikunja instances before 2.7.1 are exposed, because the tokens are written to the access log and any reverse-proxy log whenever a user clicks an emailed link. Anyone with read access to those logs can use an unredeemed token. Hosted services run by others, and instances already on 2.7.1 or later, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","reverseproxylogs","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123512':13A,16A '-2026':12A,15A 'access':9A 'cve':11A,14A 'delet':5A 'email':2A 'leak':7A 'log':10A 'reset':3A 'token':6A 'vikunja':1A","search_b":"'access':53B 'account':37B,70B 'account-delet':36B 'anyon':47B 'confirm':34B,76B 'delet':38B,73B,77B 'email':33B,45B 'email-confirm':32B 'host':24B 'http':52B 'link':46B 'live':28B 'log':21B,54B,59B 'packag':17B 'password':30B 'password-reset':29B 'proxi':20B,58B 'put':27B 'queri':42B 'read':50B 'replay':61B 'reset':31B,64B 'revers':19B,57B 'reverse-proxi':56B 'reverse-proxy-log':18B 'self':23B 'self-host':22B 'string':43B 'take':67B 'token':39B,65B,74B 'unus':63B 'vikunja':25B,26B","search_c":"'2.7.1':80C 'access':116C,133C 'account':91C,149C,153C 'account-delet':90C,152C 'attack':130C 'click':127C 'confirm':88C,157C 'delet':92C,154C,159C 'email':87C,100C 'email-confirm':86C 'emb':81C 'full':104C 'http':115C 'includ':107C 'link':101C,129C 'live':82C 'log':117C,123C,136C 'password':84C,142C 'password-reset':83C,141C 'proxi':122C 'queri':97C 'read':132C 'replay':138C 'request':105C 'reset':85C,143C 'revers':121C 'reverse-proxi':120C 'string':98C 'take':146C 'token':93C,109C,144C,155C 'unredeem':140C 'uri':106C 'url':96C 'user':126C 'vikunja':78C,113C 'written':111C","first_public_at":"2026-10-22T10:04:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123512","severity":null,"published_at":"2026-11-08T02:16:39+00:00","modified_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99173,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qf5p-grf5-wcq4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:04:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99174,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-sensitive-token-exposure-via-url-query-in-access-logs","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}