{"id":"CVE-2026-123508","aliases":[],"cve":{"records":[{"id":"CVE-2026-123508","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:46:28.480Z","published":"2026-11-08T01:37:22.496Z","modified":"2026-11-12T12:20:41.762Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:37:22.496Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T12:20:41.762Z"}],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h8wj-3gwg-jjjg","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-supply-chain-risk-via-unpinned-xgo-release-toolchain","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-494","description":"Download of Code Without Integrity Check","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*","versionEndExcluding":"2.7.1"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T12:20:18.777965Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.","score":3.1,"severity":"low","published":"2026-11-08T01:37:22.496Z","modified":"2026-11-12T12:20:41.762Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"go-vikunja","name":"vikunja","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.7.1","versionType":"semver"},{"version":"2.7.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/code.vikunja.io/api","packageIdentity":{"ecosystem":"Go","name":"code.vikunja.io/api"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123508"}],"remediation":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h8wj-3gwg-jjjg","https://www.vulncheck.com/advisories/vikunja-before-2.7.1-supply-chain-risk-via-unpinned-xgo-release-toolchain"],"sources":[{"name":"CVE","id":"CVE-2026-123508","modified":"2026-11-12T12:20:41.762Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123508"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","score":3.1}],"sourceAffected":[],"observedAt":"2026-11-12T19:28:23.394Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T04:10:31.910Z","attemptedAt":"2026-11-08T04:10:31.910Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-08T04:10:31.910Z","attemptedAt":"2026-11-08T04:10:31.910Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T04:10:31.910Z","attemptedAt":"2026-11-08T04:10:31.910Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T04:10:31.910Z","attemptedAt":"2026-11-08T04:10:31.910Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-119393","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119393","modified":"Nov 8, 2026, 1:37:22 AM","score":2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T04:10:31.910Z"},{"source":"GitHub Advisory Database","id":"GHSA-q57j-qf34-3pr5","url":"https://github.com/advisories/GHSA-q57j-qf34-3pr5","modified":"2026-11-08T03:30:34Z","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","checkedAt":"2026-11-08T04:10:31.910Z"},{"source":"NVD","id":"CVE-2026-123508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123508","modified":"2026-11-08T02:16:39.263","score":2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T04:10:31.910Z"},{"source":"NVD","id":"CVE-2026-123508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123508","modified":"2026-11-08T02:16:39.263","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","checkedAt":"2026-11-08T04:10:31.910Z"}],"aiSummary":{"text":"Vikunja before 2.7.1 has a supply chain vulnerability due to mutable references to the xgo module and Docker image. An attacker who compromises the upstream xgo module, image, or registry can inject malicious code into release binaries. This affects versions less than 2.7.1.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T01:46:06.561Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123508"}]}}