CVE-2026-123502 — MEDIUM (5.2)

Vulnerability Description

Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.

CVSS Score

5.2

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-532

References

FAQ

What is CVE-2026-123502?

CVE-2026-123502 is a vulnerability with a CVSS score of 5.2 (MEDIUM). Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route....

How severe is CVE-2026-123502?

CVE-2026-123502 has been rated MEDIUM with a CVSS base score of 5.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-123502?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.