medium · CVSS v3 5.2 · CVSS v4 6.9

CVE-2026-123502

Vikunja before 2.7.1 logs raw URIs for the /shares/:share/auth route, exposing link‑share hashes in logs. Attackers with access to these log

Overview

Vikunja before 2.7.1 logs raw URIs for the /shares/:share/auth route, exposing link‑share hashes in logs. Attackers with access to these logs can reuse the hashes to obtain project JWTs with read, write, or admin permissions. This allows unauthorized access to project data and potentially to modify or delete content.

Description

Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.

Impact

Confidentiality: attackers can read project data via leaked JWTs. Integrity: potential unauthorized modifications or deletions. Availability: not directly impacted. Defenders: system administrators and security teams monitoring log access and JWT usage.

Remediation

Upgrade to Vikunja 2.7.1 or later to fix the logging issue. Configure reverse proxies or logging middleware to mask or omit raw URIs for the /shares/:share/auth route. Restrict log file access to privileged users only. Rotate existing project JWTs and invalidate any leaked share hashes.

Risk context

The vulnerability has a medium severity (CVSS v3 5.2, v4 6.9) and no EPSS data. While it does not directly affect availability, it poses a moderate risk to confidentiality and integrity. Prompt patching and log hardening are recommended.

Affected products

  • Vikunja

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
5.2
CVSS v4
6.9
EPSS
—

information-exposure log-leak Vikunja JWT medium-severity access-control

← All CVEs

Related CVEs

medium

CVE-2026-123992

A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: "The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses.

View analysis

medium

CVE-2026-97194

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

View analysis

medium

CVE-2026-124326

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

View analysis

medium

CVE-2026-123493

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

View analysis