Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123512Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs
Medium 6.1
In plain English
A medium-severity sensitive data in logs in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-qf5p-grf5-wcq4) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs third-party-advisory