{"id":"CVE-2026-123505","aliases":[],"cve":{"records":[{"id":"CVE-2026-123505","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:46:28.479Z","published":"2026-11-08T01:37:20.424Z","modified":"2026-11-10T18:00:17.615Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:37:20.424Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T18:00:17.615Z"}],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rfw-7hv4-3vv3","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-world-readable-local-file-storage-and-sqlite-database","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-276","description":"Incorrect Default Permissions","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*","versionEndExcluding":"2.7.1"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T15:41:34.465108Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.","score":6.8,"severity":"medium","published":"2026-11-08T01:37:20.424Z","modified":"2026-11-10T18:00:17.615Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"go-vikunja","name":"vikunja","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.7.1","versionType":"semver"},{"version":"2.7.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/code.vikunja.io/api","packageIdentity":{"ecosystem":"Go","name":"code.vikunja.io/api"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123505"}],"remediation":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rfw-7hv4-3vv3","https://www.vulncheck.com/advisories/vikunja-before-2.7.1-world-readable-local-file-storage-and-sqlite-database"],"sources":[{"name":"CVE","id":"CVE-2026-123505","modified":"2026-11-10T18:00:17.615Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123505"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.8},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-10T18:16:05.155Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T04:10:36.881Z","attemptedAt":"2026-11-08T04:10:36.881Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-08T04:10:36.870Z","attemptedAt":"2026-11-08T04:10:36.870Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T04:10:37.120Z","attemptedAt":"2026-11-08T04:10:37.120Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T04:10:35.762Z","attemptedAt":"2026-11-08T04:10:35.762Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-vqcv-983h-f3vr","url":"https://github.com/advisories/GHSA-vqcv-983h-f3vr","modified":"2026-11-08T03:30:34Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-08T04:10:36.870Z"},{"source":"NVD","id":"CVE-2026-123505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123505","modified":"2026-11-08T02:16:38.737","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T04:10:36.881Z"},{"source":"NVD","id":"CVE-2026-123505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123505","modified":"2026-11-08T02:16:38.737","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-08T04:10:36.881Z"},{"source":"ENISA EUVD","id":"EUVD-2026-119390","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119390","modified":"Nov 8, 2026, 1:37:20 AM","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T04:10:37.120Z"}],"aiSummary":{"text":"Vikunja before 2.7.1 has world-readable local file storage and SQLite database due to insecure file permissions, allowing local attackers to read stored data. Local access is required to exploit this weakness. The impact includes reading attachments and cracking password hashes offline.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T01:46:24.887Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123505"}]}}