---
id: "CVE-2026-123504"
page: "https://infrastack.ai/live/CVE-2026-123504"
kind: "vulnerability"
aliases: ["CVE-2026-123504"]
title: "Vikunja: read-only project members can see webhook URLs with embedded tokens"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikunja", "webhooks"]
not_affected_if: ["fixed-version", "no-webhook-secrets"]
published_at: "2026-11-08T02:16:38+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:25:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123504", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: read-only project members can see webhook URLs with embedded tokens

Link for people: https://infrastack.ai/live/CVE-2026-123504 (this .md is for agents)

Vikunja, an open-source task manager, lets read-only project members list project webhooks and see full target URLs. Those URLs can contain webhook tokens or API keys, which an attacker can use to post to receiving channels or reuse until rotated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Vikunja version against the affected range from 0.22.0 up to but not including 2.7.1.
- Review project webhooks for target URLs that embed tokens or API keys.

## Fix

- Upgrade Vikunja to `2.7.1` or later.
- Rotate any tokens or API keys embedded in webhook target URLs.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123504

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-586f-48mj-3rwr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.1-webhook-url-credential-exposure-to-read-only-members

## From the sources

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_