Cpe:2.3:a:logseq:logseq:2.0.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3alogseqlogseq2.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 07:31:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLogseq: Authentication bypass in Local HTTP API (CVE-2026-124573)https://feed.craftedsignal.io/briefs/2026-11-logseq-auth-bypass/Mon, 09 Nov 2026 07:31:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-logseq-auth-bypass/Logseq versions 2.0.1 and 2.0.2 contain an authentication bypass vulnerability in the Local HTTP API that allows remote, unauthenticated access to the application.A vulnerability exists in the Logseq Local HTTP API component, specifically within the 'validate-auth-token' function located in 'src/electron/electron/server.cljs'. The flaw allows for missing authentication, permitting remote attackers to interact with the API without valid credentials. This vulnerability has an existing public exploit. As of the time of reporting, the vendor has not responded to the initial issue disclosure.

Impact

The vulnerability allows remote, unauthenticated access to the Logseq Local HTTP API, which may lead to unauthorized data access or manipulation within the application depending on the API's capabilities.

Recommendation

  • Inventory all instances of Logseq running with the Local HTTP API enabled.
  • Disable the Local HTTP API feature in affected versions (2.0.1 and 2.0.2) until a patch is released by the vendor.
  • Restrict network access to the Local HTTP API port to only trusted local interfaces if the feature must remain enabled.
]]>highadvisory