Vikunja loads plugins and writes logs outside its root path
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
Vikunja before 2.7.1 does not anchor its plugin and log directories to the configured rootpath, so they resolve against the startup working directory. A local attacker who can write to that directory can plant plugins that the server loads when plugins are enabled, or read misplaced logs such as audit.log (CWE-427). The CVSS 4.0 base score is 1.0 (LOW).
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-vikunja | vikunja | before 2.7.1 | 2.7.1 | Patch available | CNA |
- vikunja Vendorgo-vikunja Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* | — | — | go-vikunja |
- cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja
Remediation
Upgrade go-vikunja vikunja to version 2.7.1, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA vikunja (go-vikunja) Fixed in 2.7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
go-vikunja vikunja 2.7.1
39 records Highest priority Priority MEDIUM 20 MEDIUM, 19 LOW
Other records, highest priority first
- TI-2026-86673 Pagination limit bypass in Vikunja lets users exhaust resourcesPriority MEDIUM 53
- TI-2026-86654 Vikunja exposes password-reset tokens in access logsPriority MEDIUM 52
- TI-2026-86670 Insufficient session expiration in Vikunja token middlewarePriority MEDIUM 48
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123510
- 2026-11-08 Alias added: GHSA-29xm-vfjq-28wr
References
More go-vikunja vulnerabilities
- TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
- TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
- TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
- TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
- TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
- TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-123510 · CVE Program
- CVE-2026-123510 · NVD
- GHSA-29xm-vfjq-28wr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences