CVE-2026-123506 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, an open-source task manager, lets a token scoped only to projects_webhooks manage the owner's user-level webhooks by supplying user_id in the request body. An attacker with such a token can register a webhook to their own server to receive reminders and task data from all of the owner's projects, and can read, change or delete existing user webhooks.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted or managed Vikunja instances running from 2.2.0 up to but not including 2.7.1 that issue API tokens scoped to projects_webhooks. Exposure depends on whether such tokens exist and who holds them; instances without API tokens of that scope are less exposed. The sources do not say whether a specific deployment configuration is required.
Not affected if no-projects-webhooks-tokens, version-outside-range
Who cares api-tokens, self-hosted, vikunja, webhooks
vikunja version or the version shown in the web UI's about page, and compare it with the affected range 2.2.0 to before 2.7.1.2.7.1 or later.Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.