{"id":"CVE-2026-123506","kind":"vulnerability","aliases":["CVE-2026-123506"],"related":[],"title":"Vikunja: scoped webhook tokens can manage owner's user webhooks","description":"Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.","summary":"Vikunja, an open-source task manager, lets a token scoped only to projects_webhooks manage the owner's user-level webhooks by supplying user_id in the request body. An attacker with such a token can register a webhook to their own server to receive reminders and task data from all of the owner's projects, and can read, change or delete existing user webhooks.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-tokens","package","self-hosted","vikunja","webhooks"],"not_affected_if":["no-projects-webhooks-tokens","version-outside-range"],"how_to_check":"- Check the running Vikunja version, for example with `vikunja version` or the version shown in the web UI's about page, and compare it with the affected range `2.2.0` to before `2.7.1`.\n- Review API tokens with the projects_webhooks scope in the Vikunja instance and confirm who holds them.\n- Review user-level webhooks in the owner's account for unknown receiver URLs.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:38+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:25:14+00:00","updated_at":"2026-11-08T02:25:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:14Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"network","title":"Vikunja: scoped webhook tokens can manage owner's user webhooks","impact":"medium","summary":"Vikunja, an open-source task manager, lets a token scoped only to projects_webhooks manage the owner's user-level webhooks by supplying user_id in the request body. An attacker with such a token can register a webhook to their own server to receive reminders and task data from all of the owner's projects, and can read, change or delete existing user webhooks.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","api-tokens","webhooks"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads task data from owner's projects and manages webhooks","analyst_note":"Confirm the fixed version from the vendor advisory on github.com and the VulnCheck advisory; sources do not state detailed mitigations beyond the upgrade.","how_to_check":"- Check the running Vikunja version, for example with `vikunja version` or the version shown in the web UI's about page, and compare it with the affected range `2.2.0` to before `2.7.1`.\n- Review API tokens with the projects_webhooks scope in the Vikunja instance and confirm who holds them.\n- Review user-level webhooks in the owner's account for unknown receiver URLs.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-projects-webhooks-tokens"],"who_is_affected":"Self-hosted or managed Vikunja instances running from 2.2.0 up to but not including 2.7.1 that issue API tokens scoped to projects_webhooks. Exposure depends on whether such tokens exist and who holds them; instances without API tokens of that scope are less exposed. The sources do not say whether a specific deployment configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000779,"input_tokens":4309,"output_tokens":696,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123506':13A,16A '-2026':12A,15A '2.2.0':95C '2.7.1':97C 'allow':104C 'api':18B 'api-token':17B 'attack':58B,129C 'author':100C 'bodi':56B,128C 'bypass':101C 'chang':87B,150C 'contain':98C 'cve':11A,14A 'data':76B 'delet':89B,152C 'exist':90B,153C 'holder':105C 'host':23B 'id':52B,125C 'let':33B 'level':47B,120C 'manag':6A,32B,41B,114C 'obtain':139C 'open':29B 'open-sourc':28B 'owner':7A,43B,81B,116C,146C 'packag':20B 'payload':143C 'project':39B,83B,111C,147C 'read':86B,149C 'receiv':72B,137C 'regist':64B,131C 'remind':73B,140C 'request':55B,127C 'scope':2A,36B,108C 'self':22B 'self-host':21B 'server':70B 'sourc':30B 'suppli':50B,123C 'task':31B,75B,142C 'token':4A,19B,35B,62B,107C 'user':9A,46B,51B,91B,119C,124C,132C,154C 'user-level':45B,118C 'vikunja':1A,24B,26B,93C 'vulner':102C 'webhook':3A,10A,25B,40B,48B,66B,92B,112C,121C,133C,155C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Vikunja instances running from 2.2.0 up to but not including 2.7.1 that issue API tokens scoped to projects_webhooks. Exposure depends on whether such tokens exist and who holds them; instances without API tokens of that scope are less exposed. The sources do not say whether a specific deployment configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apitokens","medium","package","selfhosted","vikunja","webhooks"],"campaign_type":null,"search_a":"'-123506':13A,16A '-2026':12A,15A 'cve':11A,14A 'manag':6A 'owner':7A 'scope':2A 'token':4A 'user':9A 'vikunja':1A 'webhook':3A,10A","search_b":"'api':18B 'api-token':17B 'attack':58B 'bodi':56B 'chang':87B 'data':76B 'delet':89B 'exist':90B 'host':23B 'id':52B 'let':33B 'level':47B 'manag':32B,41B 'open':29B 'open-sourc':28B 'owner':43B,81B 'packag':20B 'project':39B,83B 'read':86B 'receiv':72B 'regist':64B 'remind':73B 'request':55B 'scope':36B 'self':22B 'self-host':21B 'server':70B 'sourc':30B 'suppli':50B 'task':31B,75B 'token':19B,35B,62B 'user':46B,51B,91B 'user-level':45B 'vikunja':24B,26B 'webhook':25B,40B,48B,66B,92B","search_c":"'2.2.0':95C '2.7.1':97C 'allow':104C 'attack':129C 'author':100C 'bodi':128C 'bypass':101C 'chang':150C 'contain':98C 'delet':152C 'exist':153C 'holder':105C 'id':125C 'level':120C 'manag':114C 'obtain':139C 'owner':116C,146C 'payload':143C 'project':111C,147C 'read':149C 'receiv':137C 'regist':131C 'remind':140C 'request':127C 'scope':108C 'suppli':123C 'task':142C 'token':107C 'user':119C,124C,132C,154C 'user-level':118C 'vikunja':93C 'vulner':102C 'webhook':112C,121C,133C,155C","first_public_at":"2026-10-22T10:02:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123506","severity":null,"published_at":"2026-11-08T02:16:38+00:00","modified_at":"2026-11-08T02:16:38+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99161,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5f6v-j6xm-wwj9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:02:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99162,"url":"https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-token-scope-bypass-via-project-webhook-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}