{"id":"CVE-2026-123504","kind":"vulnerability","aliases":["CVE-2026-123504"],"related":[],"title":"Vikunja: read-only project members can see webhook URLs with embedded tokens","description":"Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.","summary":"Vikunja, an open-source task manager, lets read-only project members list project webhooks and see full target URLs. Those URLs can contain webhook tokens or API keys, which an attacker can use to post to receiving channels or reuse until rotated.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja","webhooks"],"not_affected_if":["fixed-version","no-webhook-secrets"],"how_to_check":"- Check the running Vikunja version against the affected range from 0.22.0 up to but not including 2.7.1.\n- Review project webhooks for target URLs that embed tokens or API keys.","fix":"- Upgrade Vikunja to `2.7.1` or later.\n- Rotate any tokens or API keys embedded in webhook target URLs.","status":"open","published_at":"2026-11-08T02:16:38+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:25:23+00:00","updated_at":"2026-11-08T02:25:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.1` or later.\n- Rotate any tokens or API keys embedded in webhook target URLs.","reach":"network","title":"Vikunja: read-only project members can see webhook URLs with embedded tokens","impact":"medium","summary":"Vikunja, an open-source task manager, lets read-only project members list project webhooks and see full target URLs. Those URLs can contain webhook tokens or API keys, which an attacker can use to post to receiving channels or reuse until rotated.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","webhooks"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Read-only members extract webhook tokens and API keys to post or reuse","analyst_note":"","how_to_check":"- Check the running Vikunja version against the affected range from 0.22.0 up to but not including 2.7.1.\n- Review project webhooks for target URLs that embed tokens or API keys.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-webhook-secrets"],"who_is_affected":"Teams that self-host Vikunja 0.22.0 through 2.7.1 and use project webhooks whose target URLs contain secrets. Read-only project members can view those URLs, so the exposure is limited to people with project access. Installations on fixed versions, or with no webhooks carrying secrets, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4278,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123504':16A,19A '-2026':15A,18A '0.22.0':72C '2.7.1':74C 'allow':81C 'api':54B,105C 'attack':58B,97C 'channel':65B,116C 'contain':50B,75C 'cve':14A,17A 'disclosur':78C 'embed':12A,107C 'extract':99C 'full':44B,89C 'host':23B 'incom':101C 'incoming-webhook':100C 'inform':77C 'key':55B,106C,119C 'let':33B 'list':39B,94C 'manag':32B 'member':6A,38B,86C 'open':29B 'open-sourc':28B 'packag':20B 'post':62B,113C 'project':5A,37B,40B,85C,95C 'read':3A,35B,83C 'read-on':2A,34B,82C 'receiv':64B,115C 'reus':67B,118C 'rotat':69B,121C 'see':8A,43B 'self':22B 'self-host':21B 'sourc':30B 'target':45B,91C,109C 'task':31B 'token':13A,52B,103C 'url':10A,46B,48B,92C,110C 'use':60B 'valu':111C 'view':88C 'vikunja':1A,24B,26B,70C 'vulner':79C 'webhook':9A,25B,41B,51B,90C,96C,102C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja 0.22.0 through 2.7.1 and use project webhooks whose target URLs contain secrets. Read-only project members can view those URLs, so the exposure is limited to people with project access. Installations on fixed versions, or with no webhooks carrying secrets, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vikunja","webhooks"],"campaign_type":null,"search_a":"'-123504':16A,19A '-2026':15A,18A 'cve':14A,17A 'embed':12A 'member':6A 'project':5A 'read':3A 'read-on':2A 'see':8A 'token':13A 'url':10A 'vikunja':1A 'webhook':9A","search_b":"'api':54B 'attack':58B 'channel':65B 'contain':50B 'full':44B 'host':23B 'key':55B 'let':33B 'list':39B 'manag':32B 'member':38B 'open':29B 'open-sourc':28B 'packag':20B 'post':62B 'project':37B,40B 'read':35B 'read-on':34B 'receiv':64B 'reus':67B 'rotat':69B 'see':43B 'self':22B 'self-host':21B 'sourc':30B 'target':45B 'task':31B 'token':52B 'url':46B,48B 'use':60B 'vikunja':24B,26B 'webhook':25B,41B,51B","search_c":"'0.22.0':72C '2.7.1':74C 'allow':81C 'api':105C 'attack':97C 'channel':116C 'contain':75C 'disclosur':78C 'embed':107C 'extract':99C 'full':89C 'incom':101C 'incoming-webhook':100C 'inform':77C 'key':106C,119C 'list':94C 'member':86C 'post':113C 'project':85C,95C 'read':83C 'read-on':82C 'receiv':115C 'reus':118C 'rotat':121C 'target':91C,109C 'token':103C 'url':92C,110C 'valu':111C 'view':88C 'vikunja':70C 'vulner':79C 'webhook':90C,96C,102C","first_public_at":"2026-10-22T10:02:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123504","severity":null,"published_at":"2026-11-08T02:16:38+00:00","modified_at":"2026-11-08T02:16:38+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99157,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-586f-48mj-3rwr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:02:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99158,"url":"https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.1-webhook-url-credential-exposure-to-read-only-members","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}