Sensitive Token Exposure in Vikunja by Open Source Software

CVE-2026-123512

What is CVE-2026-123512?

Earlier versions of Vikunja, prior to 2.7.1, contain a vulnerability that exposes sensitive operation tokens—such as those used for password resets and account deletions—via URL query strings in emailed links. This oversight leads to the full request URI being logged in Vikunja's HTTP access logs as well as any reverse-proxy logs when users follow these links. Malicious entities with access to these logs can potentially execute unauthorized actions, such as redeeming a reset token to seize control of an account or confirming account deletions through leaked tokens, risking user data integrity and service reliability.

References