{"id":"CVE-2026-111919","kind":"vulnerability","aliases":["CVE-2026-111919"],"related":[],"title":"Vikunja: removed collaborators keep receiving project data via webhooks","description":"Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.","summary":"Vikunja 0.22.0 before 2.7.0 does not revoke webhooks a user created after that user loses project access. A removed collaborator keeps receiving task titles and descriptions, including new content, through that webhook.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja","webhooks"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Vikunja version; it is affected if it is 0.22.0 up to but not including `2.7.0`.\n- Review existing webhooks in each project for webhooks created by users who have since been removed as collaborators.","fix":"- Upgrade Vikunja to `2.7.0` or later.\n- Delete webhooks created by former collaborators until the upgrade is done. unknown whether the sources list a further workaround.","status":"open","published_at":"2026-10-17T19:16:34+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:14+00:00","updated_at":"2026-10-25T03:36:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.0` or later.\n- Delete webhooks created by former collaborators until the upgrade is done. unknown whether the sources list a further workaround.","reach":"network","title":"Vikunja: removed collaborators keep receiving project data via webhooks","impact":"medium","summary":"Vikunja 0.22.0 before 2.7.0 does not revoke webhooks a user created after that user loses project access. A removed collaborator keeps receiving task titles and descriptions, including new content, through that webhook.","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","webhooks"],"confidence":0.7,"needs_auth":"yes","worst_case":"Removed collaborators keep reading project task titles and descriptions.","analyst_note":"","how_to_check":"- Check the installed Vikunja version; it is affected if it is 0.22.0 up to but not including `2.7.0`.\n- Review existing webhooks in each project for webhooks created by users who have since been removed as collaborators.","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Self-hosted or managed Vikunja instances running versions from 0.22.0 before 2.7.0 that use webhooks on shared projects. Exposure requires that a collaborator created a webhook and was later removed from the project. Instances without webhooks or without shared projects are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000594,"input_tokens":3318,"output_tokens":525,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111919':12A,15A '-2026':11A,14A '0.22.0':23B,55C '2.7.0':25B,57C 'access':38B,61C,93C 'allow':65C 'collabor':3A,41B,67C,78C 'contain':58C 'content':50B,89C 'creat':32B,76C,90C 'cve':10A,13A 'data':7A,72C 'descript':47B,84C 'former':77C 'host':19B 'improp':60C 'includ':48B,88C 'keep':4A,42B,69C,79C 'lose':36B 'new':49B 'packag':16B 'project':6A,37B,71C 'receiv':5A,43B,70C,80C 'remov':2A,40B,66C 'revoc':62C 'revok':28B,95C 'self':18B 'self-host':17B 'task':44B,81C 'titl':45B,82C 'user':31B,35B 'via':8A 'vikunja':1A,20B,22B,54C 'vulner':63C 'webhook':9A,21B,29B,53B,74C,87C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Vikunja instances running versions from 0.22.0 before 2.7.0 that use webhooks on shared projects. Exposure requires that a collaborator created a webhook and was later removed from the project. Instances without webhooks or without shared projects are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111919","severity":null,"published_at":"2026-10-17T19:16:34+00:00","modified_at":"2026-10-19T22:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}