6.9
Medium
CVE-2026-124573 logseq Local HTTP API server.cljs validate-auth-token missing authentication
Description
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| logseq 2.0 | 2.0.1 → 2.0.2 | No fix stated |