---
id: "CVE-2026-124573"
page: "https://infrastack.ai/live/CVE-2026-124573"
kind: "vulnerability"
aliases: ["CVE-2026-124573"]
title: "Logseq: local HTTP API skips authentication, letting remote requests through"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "logseq", "fixed": [], "affected": "2.0.1, 2.0.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["desktop", "electron", "logseq", "package"]
not_affected_if: ["other-versions"]
published_at: "2026-11-09T07:17:31+00:00"
first_seen_at: "2026-11-09T07:25:05+00:00"
updated_at: "2026-11-09T07:28:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124573", "first_seen_at": "2026-11-09T07:25:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T07:28:06+00:00"}]
exploit_sources: []
---

# Logseq: local HTTP API skips authentication, letting remote requests through

Link for people: https://infrastack.ai/live/CVE-2026-124573 (this .md is for agents)

Logseq 2.0.1 and 2.0.2 have a flaw in the token check of the Local HTTP API in the Electron server, so requests are accepted without authentication. The exploit has been published, and the project has not yet responded to an earlier issue report.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:logseq affected 2.0.1, 2.0.2 fixed no fixed version listed

## How to check

- Check the installed Logseq version (Settings > About); 2.0.1 and 2.0.2 are the versions named by the CVE record.
- Also check whether the Local HTTP API server is enabled (Settings > Features > HTTP APIs server); the sources do not say it is on by default. If it is off, the flaw is not reachable.
- If you build from source, see validate-auth-token in src/electron/electron/server.cljs.

## Timeline

- 2026-11-09T07:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124573
- 2026-11-09T07:28:06+00:00 analyst — Could not find the vendor issue or advisory for this CVE (web-cli out of Exa credits; GitHub issue search found only unrelated [security] issues #13594-13596, which are empty or about other flaws). Releases seen: 2.0.1 (2026-07-13), 2.0.2 (2026-10-07), nightly (2026-10-25). No fixed version found. Whether the Local HTTP API is on by default is unconfirmed. Nothing verified. To settle: find the VulDB entry or the issue linked from it, and read server.cljs in the nightly branch.

## From the sources

A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_