Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-123512— Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

Quick assessment

Affected

go-vikunja vikunja

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2.7.1 版本之前的 Vikunja 会将实时有效的密码重置、邮件确认以及账户删除令牌嵌入到邮件链接的 URL 查询参数中。因此，当用户点击该链接时，包含令牌的完整请求 URI 会被记录在 Vikunja 的 HTTP 访问日志以及任何反向代理日志中。拥有这些日志读取权限的攻击者可以重放尚未使用的密码重置令牌以接管账户，或重放账户删除令牌以确认删除操作。

CVSS 6.1 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1110 · Brute Force

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

Source: CVE Program / CVE List V5

Vulnerability Description

Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过日志文件的信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
go-vikunja	vikunja	0 ~ 2.7.1	-

II. Public POCs for CVE-2026-123512

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123512

请登录查看更多情报信息。

Other References for CVE-2026-123512 (2)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qf5p-grf5-wcq4 vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-sensitive-token-exposure-via-url-query-in-access-logs third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123512

Same Patch Batch · go-vikunja · 2026-11-08 · 39 CVEs total

CVE-2026-123531	8.8 HIGH	Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter
CVE-2026-123522	7.1 HIGH	Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook
CVE-2026-123520	7.1 HIGH	Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion
CVE-2026-123497	6.8 MEDIUM	Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
CVE-2026-123528	6.8 MEDIUM	Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
CVE-2026-123513	6.8 MEDIUM	Vikunja before 2.7.1 Auth Token Leak via API URL Change
CVE-2026-123525	6.5 MEDIUM	Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrati
CVE-2026-123523	6.5 MEDIUM	Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache
CVE-2026-123519	6.5 MEDIUM	Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
CVE-2026-123501	6.5 MEDIUM	Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
CVE-2026-123500	6.2 MEDIUM	Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
CVE-2026-123499	5.9 MEDIUM	Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
CVE-2026-123530	5.9 MEDIUM	Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints
CVE-2026-123521	5.9 MEDIUM	Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint
CVE-2026-123524	5.7 MEDIUM	Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload
CVE-2026-123505	5.5 MEDIUM	Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
CVE-2026-123493	5.4 MEDIUM	Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123526	5.4 MEDIUM	Vikunja before 2.7.1 Mass Assignment via Team external_id Field
CVE-2026-123506	5.4 MEDIUM	Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
CVE-2026-123503	5.4 MEDIUM	Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: vikunja

Same vendor: go-vikunja

Same weakness: CWE-532