CVE-2026-123502 Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123502?
CVE-2026-123502 is a medium-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.
Weakness: CWE-532
Which versions are affected by CVE-2026-123502?
How do I fix CVE-2026-123502?
No fix has been published for CVE-2026-123502 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123502 being exploited?
There is no known exploitation of CVE-2026-123502 in the wild and no public exploit code.
Sources
Also known as GHSA-526f-fc44-8pmq, GHSA-ff52-3296-2fvr.