Security: Auth token stored in world-readable plaintext config file #4

New issue

Closed

opened 2026-05-09 05:18:40 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 05:18:40 +00:00

Owner

Severity: Medium

The ConfigManager writes the API token to ~/.vikunja-cli-config.json (or --config path) in plaintext without restricting file permissions.

File: vikunja_cli/config/config_manager.py / vikunjatool/utils/config.py, method save_config()

def save_config(self) -> None:
    os.makedirs(os.path.dirname(str(self.config_path)), exist_ok=True)
    with open(self.config_path, 'w') as f:
        json.dump(self.config, f, indent=2)

Impact:

Any process or user with read access to the home directory can read the token
Default umask often results in 644 permissions, making it readable by other users on multi-user systems

Fix: Set restrictive file permissions (e.g., os.chmod(self.config_path, 0o600)) after writing, or use a keyring / encrypted storage. Consider also masking the config path display to avoid leaking the location in command output.

**Severity: Medium** The ConfigManager writes the API token to `~/.vikunja-cli-config.json` (or `--config` path) in plaintext without restricting file permissions. **File:** `vikunja_cli/config/config_manager.py` / `vikunjatool/utils/config.py`, method `save_config()` ```python def save_config(self) -> None: os.makedirs(os.path.dirname(str(self.config_path)), exist_ok=True) with open(self.config_path, 'w') as f: json.dump(self.config, f, indent=2) ``` **Impact:** - Any process or user with read access to the home directory can read the token - Default umask often results in 644 permissions, making it readable by other users on multi-user systems **Fix:** Set restrictive file permissions (e.g., `os.chmod(self.config_path, 0o600)`) after writing, or use a keyring / encrypted storage. Consider also masking the config path display to avoid leaking the location in command output.

Mark commented

2026-05-13 15:56:06 +00:00

Author

Owner

Fixed in commit. Closing.