CVE-2026-124573

CVSS 7.3 (high) · published 2026-11-09

A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Weakness: CWE-287, CWE-306

Source: NVD CVE-2026-124573

References

• https://github.com/logseq/logseq/
• https://github.com/logseq/logseq/issues/13596
• https://vuldb.com/cve/CVE-2026-124573
• https://vuldb.com/submit/1035945
• https://vuldb.com/vuln/432919
• https://vuldb.com/vuln/432919/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.