{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alogseqlogseq2.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:logseq:logseq:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:logseq:logseq:2.0.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-124573"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Logseq (2.0.1, 2.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Logseq"],"content_html":"\u003cp\u003eA vulnerability exists in the Logseq Local HTTP API component, specifically within the 'validate-auth-token' function located in 'src/electron/electron/server.cljs'. The flaw allows for missing authentication, permitting remote attackers to interact with the API without valid credentials. This vulnerability has an existing public exploit. As of the time of reporting, the vendor has not responded to the initial issue disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows remote, unauthenticated access to the Logseq Local HTTP API, which may lead to unauthorized data access or manipulation within the application depending on the API's capabilities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of Logseq running with the Local HTTP API enabled.\u003c/li\u003e\n\u003cli\u003eDisable the Local HTTP API feature in affected versions (2.0.1 and 2.0.2) until a patch is released by the vendor.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Local HTTP API port to only trusted local interfaces if the feature must remain enabled.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T07:31:57Z","date_published":"2026-11-09T07:31:57Z","id":"https://feed.craftedsignal.io/briefs/2026-11-logseq-auth-bypass/","summary":"Logseq versions 2.0.1 and 2.0.2 contain an authentication bypass vulnerability in the Local HTTP API that allows remote, unauthenticated access to the application.","title":"Logseq: Authentication bypass in Local HTTP API (CVE-2026-124573)","url":"https://feed.craftedsignal.io/briefs/2026-11-logseq-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:logseq:logseq:2.0.2:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}