CVE-2026-123502Medium· 5.2▾ SunlitVikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.
vikunja < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123512Medium· 6.1Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs
CVE-2026-123494Low· 3.5Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
CVE-2026-123493Medium· 5.4Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123495Medium· 4.6Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
CVE-2026-123498Low· 3.7Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
CVE-2026-123497Medium· 6.8Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery