---
id: "CVE-2026-123506"
page: "https://infrastack.ai/live/CVE-2026-123506"
kind: "vulnerability"
aliases: ["CVE-2026-123506"]
title: "Vikunja: scoped webhook tokens can manage owner's user webhooks"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api-tokens", "package", "self-hosted", "vikunja", "webhooks"]
not_affected_if: ["no-projects-webhooks-tokens", "version-outside-range"]
published_at: "2026-11-08T02:16:38+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:25:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123506", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: scoped webhook tokens can manage owner's user webhooks

Link for people: https://infrastack.ai/live/CVE-2026-123506 (this .md is for agents)

Vikunja, an open-source task manager, lets a token scoped only to projects_webhooks manage the owner's user-level webhooks by supplying user_id in the request body. An attacker with such a token can register a webhook to their own server to receive reminders and task data from all of the owner's projects, and can read, change or delete existing user webhooks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Vikunja version, for example with `vikunja version` or the version shown in the web UI's about page, and compare it with the affected range `2.2.0` to before `2.7.1`.
- Review API tokens with the projects_webhooks scope in the Vikunja instance and confirm who holds them.
- Review user-level webhooks in the owner's account for unknown receiver URLs.

## Fix

- Vikunja: move to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123506

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5f6v-j6xm-wwj9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-token-scope-bypass-via-project-webhook-endpoints

## From the sources

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_