Quick answers
- Is CVE-2026-123502 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-123502 being exploited in the wild.
- How severe is CVE-2026-123502?
- Medium severity, with a CVSS score of 5.2, published 8 November 2026.
- Which products and versions are affected?
- Vikunja before 2.7.1.
- Is there a fix for CVE-2026-123502?
- Yes: fixed in 2.7.1. Until then: Log the route template instead of the raw URI to prevent share hashes from appearing in access logs. Restrict access to Vikunja and reverse proxy logs to trusted administrators only. Use password protection on sensitive share links. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-123502 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-123502?
- Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 2.7.1
Log the route template instead of the raw URI to prevent share hashes from appearing in access logs. Restrict access to Vikunja and reverse proxy logs to trusted administrators only. Use password protection on sensitive share links.
Technical details
The POST /api/v{1,2}/shares/:share/auth route logs the raw URI, exposing the share hash as a path segment in access logs. For password-less shares, the hash alone can be redeemed for a project JWT with the share's permission level. Hashes do not expire, so a log reader gains persistent access to any shared project they discover this way. Requires read access to logs and the share to be accessed at least once.
Affected products
- Vikunja Vikunja before 2.7.1
Timeline
- 2026-10-22: disclosed: GitHub Security Advisory GHSA-ff52-3296-2fvr published
- 2026-11-08: advisory