Logseq EUVD-2026-119838

Exploitation requires that Logseq's Local HTTP API server be enabled (it is an opt-in feature, not on by default), and that the attacker can reach its listening port; where that port is bound to localhost only, practical exploitation is limited to local or host-adjacent attackers despite the AV:N rating. No valid API token, authentication, or user interaction is needed once the endpoint is reachable, because validate-auth-token fails to enforce authentication (CWE-306). The primary limiting factors are therefore the non-default enablement of the HTTP API and the network reachability of its port; affected versions are 2.0.1 and 2.0.2, and no fixed version is currently available since the vendor has not responded.

Signals point to a genuine but bounded concern rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and the CWE-306 missing-authentication root cause in validate-auth-token is consistent with that. However, the vulnerable surface is Logseq's Local HTTP API - an optional feature that must be enabled - which materially narrows real exposure versus what a raw AV:N implies, and impact is capped at Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), so the product-level severity is Medium (6.9). There is no CISA KEV listing and no EPSS score supplied, so widespread or automated exploitation is not evidenced. The exploit maturity flag E:P and the referenced GitHub issue indicate a public PoC reference exists, but the input marks it as not verified as working exploit code, so this should not be read as confirmed weaponization. Conflict to verify with vendor: the description says 'the attack may be performed from remote' and CVSS sets AV:N, yet a 'Local HTTP API' may in practice bind to loopback only - confirm whether the server is reachable off-host or only exploitable where the API port is exposed. The vulDB decision label is 'this_month', aligning with a prioritized-but-not-immediate posture.

An attacker who can reach a Logseq instance that has the Local HTTP API server enabled sends an HTTP request to an API endpoint without a valid auth token; because validate-auth-token fails to enforce authentication, the request is accepted and the attacker can read and manipulate the user's notes/graph data. A public PoC reference exists (the GitHub issue) but is not verified as working exploit code. Given AV:N/AC:L/PR:N, no special skill, authentication, or user interaction is required once the API port is reachable.