Live › vulnerability › CVE-2026-111919
Go to dashboardVikunja 0.22.0 before 2.7.0 does not revoke webhooks a user created after that user loses project access. A removed collaborator keeps receiving task titles and descriptions, including new content, through that webhook.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Vikunja instances running versions from 0.22.0 before 2.7.0 that use webhooks on shared projects. Exposure requires that a collaborator created a webhook and was later removed from the project. Instances without webhooks or without shared projects are less exposed.
No product ranges from the sources yet.
2.7.0.2.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.
This page as .md · .json · in your agent: get_signal("CVE-2026-111919")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.