Dashboard / CVE-2026-123496

CVE-2026-123496

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 35/100
Published: 2026-11-08 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: None
VI: Low
VA: None

Description

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
go-vikunja vikunja 0 < 2.7.1

References & Advisories (2)

Bug Bounty Relevance

35 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.13%
Raw Score 0.001320
Percentile 2.8%
Date 2026-11-08

Intelligence Sources

mitre ref →
nvd ref →

External Links