# CVE-2026-124573: Logseq missing authentication in Local HTTP API

Source: https://junglewise.ai/threats/cve-2026-124573-a-vulnerability-was-found-in-logseq-2-0-1-2-0-2-this-affects-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124573 · Severity: high · CVSS 7.3 · Published 2026-11-09

Logseq is a knowledge management and note-taking application that runs a local HTTP API server for integrating with other tools. When the API server is started with default settings (empty token list), it has no authentication, allowing any website visited by a user to execute arbitrary commands on their computer through the browser. This can lead to ransomware installation, data theft, or complete system compromise.

Technologies: [Logseq](https://junglewise.ai/threats/technologies/logseq). Vendors: [Logseq](https://junglewise.ai/threats/vendors/logseq).

## Quick answers

**Is CVE-2026-124573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124573 being exploited in the wild.

**How severe is CVE-2026-124573?** High severity, with a CVSS score of 7.3, published 9 November 2026.

**Which products and versions are affected?** Logseq 2.0.1, 2.0.2.

**Is there a fix for CVE-2026-124573?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124573 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124573?** Check whether you run Logseq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Local HTTP API server (Fastify on 127.0.0.1:12315) skips authentication entirely when the token list is empty (default state) due to a short-circuit in the when-let conditional. CORS is enabled with allow-origin *, allowing cross-origin requests from any website. An attacker can chain the unauthenticated writeDotdirFile function with directory traversal in the subRoot parameter to write arbitrary files (including executables) to any location under the user's home directory, then execute them via file: protocol or Windows Startup folder persistence. The attack vector is network/remote and requires only that the victim has Logseq running with the API server started and visits an attacker-controlled webpage.

## Affected products

- Logseq Logseq 2.0.1, 2.0.2

## Timeline

- 2026-11-09: disclosed

## References

- [https://github.com/logseq/logseq/](https://github.com/logseq/logseq/)
- [https://github.com/logseq/logseq/issues/13596](https://github.com/logseq/logseq/issues/13596)

## Related threats

- [Logseq OS command injection in IPC handler](https://junglewise.ai/threats/cve-2026-9279-logseq-os-command-injection-in-ipc-handler)
- [Logseq sandbox escape via plugin HTML attribute injection](https://junglewise.ai/threats/cve-2026-47901-logseq-sandbox-escape-via-plugin-html-attribute-injection)
- [Logseq stored XSS in plugin package.json name field](https://junglewise.ai/threats/cve-2026-47900-logseq-stored-xss-in-plugin-package-json-name-field)
- [Logseq exposed dangerous IPC method in Electron preload script](https://junglewise.ai/threats/cve-2026-47899-logseq-exposed-dangerous-ipc-method-in-electron-preload-script)