CVE-2026-111922
CVE-2026-111922 · Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.
CVSS 7.2 · Alta · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
vikunja
- Versiones
- ≥ 2.2.0, < 2.7.0: Afectada (semver)
- 2.7.0: No afectada (semver)
Actualiza a 2.7.0