The vulnerability resides in Logseq’s Local HTTP API, specifically the validate‑auth‑token function. Because the token validation is missing, an attacker can send requests to protected endpoints without authentication, gaining unauthorized access to configuration, data, or control features exposed through the API. This breach of authentication aligns with CWE‑287 and CWE‑306 weaknesses. The impact is a loss of confidentiality, integrity, and potentially availability if the attacker commands the API or disrupts its service.

Logseq Logseq versions 2.0.1 and 2.0.2 are affected. These versions expose the Local HTTP API without proper authentication checks.

The CVSS score of 6.9 indicates moderate severity; a public exploit is available and can be performed remotely against the Local HTTP API. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack path is through any network that can reach the API port, making it exploitable from remote contexts where the service is exposed.