CVE-2026-123505
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.