CVE-2026-123505: SQL Injection

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Vikunja deployments before 2.7.1 on shared hosts are exposed if untrusted local users can access the files created by the application. Those users may read attachments, project backgrounds, exports, and copy the SQLite database.

What does an attacker need to exploit it?

An attacker needs local access to the host. The issue does not describe a remote-only attack path; exploitation relies on reading world-readable blobs created by localStorage.Write.

What is the impact of copying the SQLite database?

A local attacker can copy the SQLite database and attempt to crack password hashes offline. This can put account credentials at risk beyond the directly exposed stored files.

How can I tell whether I may be affected?

Check whether Vikunja is running a version before 2.7.1 and whether its local storage files or SQLite database are readable by other local users. Review permissions on stored attachments, project backgrounds, exports, and the database file.

CVE-2026-123505: SQL Injection

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of copying the SQLite database?

How can I tell whether I may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of copying the SQLite database?

How can I tell whether I may be affected?