PT-2026-139781
CVE-2026-123500
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 4.0
6.9
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Vikunja versions prior to 2.7.1
Description
Insecure file permissions allow local users to read dump archives created by the
vikunja dump command. On shared hosting environments, local attackers can access world-readable zip files in the rootpath to retrieve configuration data, password hashes, TOTP secrets, tokens, and stored files.Recommendations
Update to version 2.7.1 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾