CVE-2026-123504 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, an open-source task manager, lets read-only project members list project webhooks and see full target URLs. Those URLs can contain webhook tokens or API keys, which an attacker can use to post to receiving channels or reuse until rotated.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja 0.22.0 through 2.7.1 and use project webhooks whose target URLs contain secrets. Read-only project members can view those URLs, so the exposure is limited to people with project access. Installations on fixed versions, or with no webhooks carrying secrets, can skip it.
Not affected if fixed-version, no-webhook-secrets
Who cares self-hosted, vikunja, webhooks
2.7.1 or later.Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.