CVE-2026-123496
Vikunja veans before 2.7.1 Symlink Following in veans init
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
CVE List Score used
Vikunja veans before 2.7.1 Symlink Following in veans init
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.
- Record
CVE-2026-123496- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-59
- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-123496 is a medium vulnerability (CVSS 4.8) in Go-vikunja Vikunja, published November 8, 2026. No source lists public exploit code. No source names a fixed version.