{"id":"CVE-2026-124573","kind":"vulnerability","aliases":["CVE-2026-124573"],"related":[],"title":"Logseq: local HTTP API skips authentication, letting remote requests through","description":"A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Logseq 2.0.1 and 2.0.2 have a flaw in the token check of the Local HTTP API in the Electron server, so requests are accepted without authentication. The exploit has been published, and the project has not yet responded to an earlier issue report.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"logseq","fixed":[],"affected":"2.0.1, 2.0.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","electron","logseq","package"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed Logseq version (Settings > About); 2.0.1 and 2.0.2 are the versions named by the CVE record.\n- Also check whether the Local HTTP API server is enabled (Settings > Features > HTTP APIs server); the sources do not say it is on by default. If it is off, the flaw is not reachable.\n- If you build from source, see validate-auth-token in src/electron/electron/server.cljs.","fix":null,"status":"open","published_at":"2026-11-09T07:17:31+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:30+00:00","updated_at":"2026-11-09T07:28:06+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-09T07:25:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Logseq: local HTTP API skips authentication, letting remote requests through","impact":"medium","summary":"Logseq 2.0.1 and 2.0.2 have a flaw in the token check of the Local HTTP API in the Electron server, so requests are accepted without authentication. The exploit has been published, and the project has not yet responded to an earlier issue report.","audience":"everyone","category":"package","nicknames":[],"who_cares":["logseq","electron","desktop"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote callers reach the local API without authentication.","analyst_note":"Find the vendor's fixed version or workaround in the Logseq project issue tracker or GitHub, and confirm whether the Local HTTP API is enabled by default.","how_to_check":"- Check the installed Logseq version; versions `2.0.1` and `2.0.2` are named as affected.\n- Look at `src/electron/electron/server.cljs` in the Logseq source, function `validate-auth-token`, if you build from source.","plain_action":"","product_name":"logseq","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Logseq versions 2.0.1 and 2.0.2 are named in the sources, and the flaw is in the Local HTTP API's token validation, so exposure depends on whether that API is running and reachable. The sources do not say whether the API is enabled by default. Users on other versions are not named as affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001253,"input_tokens":4563,"output_tokens":1594,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor's fixed version or workaround in the Logseq project issue tracker or GitHub, and confirm whether the Local HTTP API is enabled by default.","search":"'-124573':12A,15A '-2026':11A,14A '/2.0.2':71C '2.0.1':22B,70C '2.0.2':24B 'accept':44B 'affect':73C 'api':4A,36B,89C 'attack':97C 'auth':78C 'authent':6A,46B,95C 'check':31B 'compon':86C 'could':110C 'cve':10A,13A 'desktop':17B 'earli':120C 'earlier':61B 'electron':18B,39B 'exploit':48B,104C 'file':82C 'flaw':27B 'found':67C 'function':75C 'http':3A,35B,88C 'inform':116C 'issu':62B,123C 'let':7A 'local':2A,34B,87C 'logseq':1A,16A,19B,21B,69C 'made':107C 'manipul':91C 'may':98C 'miss':94C 'packag':20B 'perform':100C 'problem':119C 'project':54B,114C 'public':108C 'publish':51B 'remot':8A,102C 'report':63B,124C 'request':9A,42B 'respond':58B,128C 'result':92C 'server':40B 'skip':5A 'src/electron/electron/server.cljs':83C 'token':30B,79C 'use':112C 'valid':77C 'validate-auth-token':76C 'vulner':65C 'without':45B 'yet':57B,129C","nicknames":[],"mitigations":[],"who_affected":"Logseq versions 2.0.1 and 2.0.2 are named in the sources, and the flaw is in the Local HTTP API's token validation, so exposure depends on whether that API is running and reachable. The sources do not say whether the API is enabled by default. Users on other versions are not named as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":["logseq"],"ptokens":["logseq"],"labels":["desktop","electron","high","logseq","package","vendor"],"campaign_type":null,"search_a":"'-124573':12A,15A '-2026':11A,14A 'api':4A 'authent':6A 'cve':10A,13A 'http':3A 'let':7A 'local':2A 'logseq':1A,16A 'remot':8A 'request':9A 'skip':5A","search_b":"'2.0.1':22B '2.0.2':24B 'accept':44B 'api':36B 'authent':46B 'check':31B 'desktop':17B 'earlier':61B 'electron':18B,39B 'exploit':48B 'flaw':27B 'http':35B 'issu':62B 'local':34B 'logseq':19B,21B 'packag':20B 'project':54B 'publish':51B 'report':63B 'request':42B 'respond':58B 'server':40B 'token':30B 'without':45B 'yet':57B","search_c":"'/2.0.2':71C '2.0.1':70C 'affect':73C 'api':89C 'attack':97C 'auth':78C 'authent':95C 'compon':86C 'could':110C 'earli':120C 'exploit':104C 'file':82C 'found':67C 'function':75C 'http':88C 'inform':116C 'issu':123C 'local':87C 'logseq':69C 'made':107C 'manipul':91C 'may':98C 'miss':94C 'perform':100C 'problem':119C 'project':114C 'public':108C 'remot':102C 'report':124C 'respond':128C 'result':92C 'src/electron/electron/server.cljs':83C 'token':79C 'use':112C 'valid':77C 'validate-auth-token':76C 'vulner':65C 'yet':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124573","severity":null,"published_at":"2026-11-09T07:17:31+00:00","modified_at":"2026-11-09T07:17:32+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124573:2254","url":null,"severity":null,"published_at":"2026-11-09T07:28:06+00:00","modified_at":"2026-11-09T07:28:06+00:00","first_seen_at":"2026-11-09T07:28:06+00:00","fetched_at":"2026-11-09T07:28:06+00:00","note":"Could not find the vendor issue or advisory for this CVE (web-cli out of Exa credits; GitHub issue search found only unrelated [security] issues #13594-13596, which are empty or about other flaws). Releases seen: 2.0.1 (2026-07-13), 2.0.2 (2026-10-07), nightly (2026-10-25). No fixed version found. Whether the Local HTTP API is on by default is unconfirmed. Nothing verified. To settle: find the VulDB entry or the issue linked from it, and read server.cljs in the nightly branch."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}