Logseq Local HTTP API missing authentication (CVE-2026-124573)

high severity · published 2026-11-09

The validate-auth-token check in the Electron Local HTTP API server (src/electron/electron/server.cljs) fails, so requests are not properly authenticated. A remote attacker can call the Local HTTP API without a valid token; a public exploit exists.

CVE: CVE-2026-124573

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1917 and your operating system.