Is CVE-2026-123512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123512 being exploited in the wild.

How severe is CVE-2026-123512?

Medium severity, with a CVSS score of 6.1, published 8 November 2026.

How is CVE-2026-123512 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123512?

Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123512: Vikunja authentication tokens in URL query string leaking to access logs

CVE-2026-123512 · Severity: medium · CVSS 6.1 · Published 2026-11-08

Vikunja, a task management and project planning application, embeds sensitive password-reset, email-confirmation, and account-deletion tokens directly in the URL query string of emailed links. When users click these links, the full URL including the live token is recorded in HTTP access logs—both in Vikunja itself and in any reverse proxies in front of it. An attacker with read access to these logs can reuse a password-reset token to hijack an account or use an account-deletion token to confirm account deletion.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123512 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123512 being exploited in the wild.
How severe is CVE-2026-123512?: Medium severity, with a CVSS score of 6.1, published 8 November 2026.
Which products and versions are affected?: Vikunja before 2.7.1.
Is there a fix for CVE-2026-123512?: Yes: fixed in 2.7.1. Until then: Disable HTTP request logging or redact query strings in Vikunja's logger and all upstream reverse-proxy logging. Enable URL fragment routing in the frontend so tokens are moved out of the query string and not transmitted to the server. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123512 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123512?: Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.1

Disable HTTP request logging or redact query strings in Vikunja's logger and all upstream reverse-proxy logging. Enable URL fragment routing in the frontend so tokens are moved out of the query string and not transmitted to the server.

Technical details

The vulnerability stems from embedding single-use authentication tokens as URL query parameters (?userPasswordReset=, ?userEmailConfirm=, ?accountDeletionConfirm=) in emailed links; when clicked, these tokens reach Vikunja's request logger, which records the full URI to stdout at Info level by default, and similarly propagate to reverse-proxy logs. Password-reset and account-deletion tokens expire after approximately 24–25 hours; email-confirmation tokens never expire. An attacker with log read access (e.g., log aggregation system, shared reverse proxy, hosting staff) can intercept these tokens and replay them to reset a victim's password or confirm account deletion. The fix moves tokens to the URL fragment (after #), which is not sent to the server.

Affected products

Vikunja Vikunja before 2.7.1

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.