---
id: "CVE-2026-111919"
kind: "vulnerability"
aliases: ["CVE-2026-111919"]
title: "Vikunja: removed collaborators keep receiving project data via webhooks"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikunja", "webhooks"]
not_affected_if: ["default-config"]
published_at: "2026-10-17T19:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:36:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111919", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Vikunja: removed collaborators keep receiving project data via webhooks

Vikunja 0.22.0 before 2.7.0 does not revoke webhooks a user created after that user loses project access. A removed collaborator keeps receiving task titles and descriptions, including new content, through that webhook.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vikunja version; it is affected if it is 0.22.0 up to but not including `2.7.0`.
- Review existing webhooks in each project for webhooks created by users who have since been removed as collaborators.

## Fix

- Upgrade Vikunja to `2.7.0` or later.
- Delete webhooks created by former collaborators until the upgrade is done. unknown whether the sources list a further workaround.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111919

## From the sources

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_