LOGSEQ · CVE-2026-124573 · Package
NO FIX YET
Logseq 2.0.1 and 2.0.2 have a flaw in the token check of the Local HTTP API in the Electron server, so requests are accepted without authentication. The exploit has been published, and the project has not yet responded to an earlier issue report.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Logseq versions 2.0.1 and 2.0.2 are named in the sources, and the flaw is in the Local HTTP API's token validation, so exposure depends on whether that API is running and reachable. The sources do not say whether the API is enabled by default. Users on other versions are not named as affected.
Not affected if other-versions
Who cares desktop, electron, logseq
Unknown from the sources.
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.