CVE-2026-123505 | BDVDB-2026-401862 Detail

Description#

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-08Record published in the CVE List.