CVE-2026-123505 Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to cra...