{"id":"CVE-2026-123517","kind":"vulnerability","aliases":["CVE-2026-123517"],"related":[],"title":"Vikunja: team member endpoint reveals whether private teams exist","description":"Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.","summary":"Vikunja before 2.7.1 lets any logged-in user probe the team member self-removal endpoint with arbitrary team ids. The distinct responses reveal whether a private team exists, is SSO-managed, or has a single member.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","teams","vikunja"],"not_affected_if":["no-user-accounts","version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version the instance runs; it is affected below `2.7.1`.\n- Confirm whether any users can log in to the instance, since an account is required.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:31+00:00","updated_at":"2026-11-08T02:23:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:31Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"internet","title":"Vikunja: team member endpoint reveals whether private teams exist","impact":"low","summary":"Vikunja before 2.7.1 lets any logged-in user probe the team member self-removal endpoint with arbitrary team ids. The distinct responses reveal whether a private team exists, is SSO-managed, or has a single member.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","teams"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in users learn which private teams exist","analyst_note":"","how_to_check":"- Check the Vikunja version the instance runs; it is affected below `2.7.1`.\n- Confirm whether any users can log in to the instance, since an account is required.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","no-user-accounts"],"who_is_affected":"Any self-hosted or shared Vikunja instance older than 2.7.1 where users have accounts can probe for private team ids. Instances without user accounts, or running 2.7.1 or later, are not affected by this signal.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4292,"output_tokens":468,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123517':12A,15A '-2026':11A,14A '/members':96C '/teams':94C '2.7.1':24B,63C 'allow':70C 'arbitrari':40B,100C 'attack':88C 'authent':71C 'call':80C 'contain':64C 'cve':10A,13A 'delet':91C 'determin':74C 'disclosur':67C 'distinct':44B 'distinguish':106C 'endpoint':4A,38B,87C 'exist':9A,51B,78C,113C 'host':19B 'id':42B,95C,102C 'inform':66C 'learn':109C 'let':25B 'log':28B 'logged-in':27B 'manag':55B,117C 'member':3A,34B,60B,83C,122C 'packag':16B 'privat':7A,49B,76C 'probe':31B 'remov':37B,86C 'request':92C 'respons':45B,107C 'reveal':5A,46B 'self':18B,36B,85C 'self-host':17B 'self-remov':35B,84C 'send':90C 'singl':59B,121C 'sso':54B,116C 'sso-manag':53B,115C 'team':2A,8A,20B,33B,41B,50B,77C,82C,101C,112C 'use':104C 'user':30B,72C 'usernam':98C 'vikunja':1A,21B,22B,61C 'vulner':68C 'whether':6A,47B,75C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted or shared Vikunja instance older than 2.7.1 where users have accounts can probe for private team ids. Instances without user accounts, or running 2.7.1 or later, are not affected by this signal.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","teams","vikunja"],"campaign_type":null,"search_a":"'-123517':12A,15A '-2026':11A,14A 'cve':10A,13A 'endpoint':4A 'exist':9A 'member':3A 'privat':7A 'reveal':5A 'team':2A,8A 'vikunja':1A 'whether':6A","search_b":"'2.7.1':24B 'arbitrari':40B 'distinct':44B 'endpoint':38B 'exist':51B 'host':19B 'id':42B 'let':25B 'log':28B 'logged-in':27B 'manag':55B 'member':34B,60B 'packag':16B 'privat':49B 'probe':31B 'remov':37B 'respons':45B 'reveal':46B 'self':18B,36B 'self-host':17B 'self-remov':35B 'singl':59B 'sso':54B 'sso-manag':53B 'team':20B,33B,41B,50B 'user':30B 'vikunja':21B,22B 'whether':47B","search_c":"'/members':96C '/teams':94C '2.7.1':63C 'allow':70C 'arbitrari':100C 'attack':88C 'authent':71C 'call':80C 'contain':64C 'delet':91C 'determin':74C 'disclosur':67C 'distinguish':106C 'endpoint':87C 'exist':78C,113C 'id':95C,102C 'inform':66C 'learn':109C 'manag':117C 'member':83C,122C 'privat':76C 'remov':86C 'request':92C 'respons':107C 'self':85C 'self-remov':84C 'send':90C 'singl':121C 'sso':116C 'sso-manag':115C 'team':77C,82C,101C,112C 'use':104C 'user':72C 'usernam':98C 'vikunja':61C 'vulner':68C 'whether':75C","first_public_at":"2026-10-22T10:05:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123517","severity":null,"published_at":"2026-11-08T02:16:40+00:00","modified_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99183,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3r6-33v3-79c2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:05:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99184,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-information-disclosure-via-team-self-removal-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}