high · CVSS v3 6.1 · CVSS v4 8.4

CVE-2026-123512

Vikunja versions prior to 2.7.1 expose password-reset, email-confirmation, and account-deletion tokens in URLs that are logged, allowing att

Overview

Vikunja versions prior to 2.7.1 expose password-reset, email-confirmation, and account-deletion tokens in URLs that are logged, allowing attackers with log access to replay tokens and compromise accounts. This flaw can lead to unauthorized account takeover or deletion. Defenders should update or patch the application immediately.

Description

Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.

Impact

The vulnerability compromises confidentiality by exposing sensitive tokens, integrity by allowing unauthorized actions, and availability if accounts are deleted. Attackers with read access to HTTP logs can replay unredeemed tokens to take over or delete user accounts. This primarily affects administrators and users of the affected Vikunja deployment.

Remediation

Apply the official patch to Vikunja 2.7.1 or later. If patching is delayed, configure your web server or reverse proxy to strip query strings from logs or use secure token handling that does not log the token. Additionally, review and rotate any compromised tokens and monitor for suspicious log entries.

Risk context

Severity is high with CVSS v3 score 6.1 and CVSS v4 score 8.4, indicating a significant risk. No EPSS data is available, but the flaw remains exploitable until the application is updated. Defenders should treat this as a moderate-to-high urgency issue.

Affected products

  • Vikunja <2.7.1

Scores

Severity
high
CVSS v2
7.7
CVSS v3
6.1
CVSS v4
8.4
EPSS
—

token leakage logging account takeover account deletion Vikunja high severity password reset

← All CVEs

Related CVEs

high

CVE-2026-99277

In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.

View analysis

high

CVE-2026-123497

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

View analysis

high

CVE-2026-123501

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.

View analysis

high

CVE-2026-123513

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

View analysis