{"id":"CVE-2026-123520","kind":"vulnerability","aliases":["CVE-2026-123520"],"related":[],"title":"Vikunja: team owners can seize read-only shared projects by deleting bots","description":"Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering ensureProjectAdminUser to promote read-only shares and lock out the real owner.","summary":"Vikunja, a self-hosted task manager, lets a team owner create a bot, add it to a team, and delete it, which promotes read-only shared projects so the attacker gains admin or ownership and can lock out the real owner. The result is that an attacker takes control of projects they were only allowed to view.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","team-sharing","vikunja"],"not_affected_if":["no-team-sharing","version-2.7.1-or-later"],"how_to_check":"- Check the installed Vikunja version; it is affected from `0.18.0` before `2.7.1`.\n- Look for team owners who are not expected to hold project admin rights on shared projects.\n- Review recent bot account creation and deletion through the bots endpoint.","fix":"- Move Vikunja to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:29+00:00","updated_at":"2026-11-08T02:23:29+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T02:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move Vikunja to `2.7.1` or later.","reach":"network","title":"Vikunja: team owners can seize read-only shared projects by deleting bots","impact":"medium","summary":"Vikunja, a self-hosted task manager, lets a team owner create a bot, add it to a team, and delete it, which promotes read-only shared projects so the attacker gains admin or ownership and can lock out the real owner. The result is that an attacker takes control of projects they were only allowed to view.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["vikunja","self-hosted","team-sharing"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains admin of shared projects and locks out the real owner","analyst_note":"","how_to_check":"- Check the installed Vikunja version; it is affected from `0.18.0` before `2.7.1`.\n- Look for team owners who are not expected to hold project admin rights on shared projects.\n- Review recent bot account creation and deletion through the bots endpoint.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","no-team-sharing"],"who_is_affected":"Teams running self-hosted Vikunja from 0.18.0 up to but not including 2.7.1 that share projects read-only with other users. Instances on 2.7.1 or later, or with no team sharing, are not exposed. The sources do not say whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4299,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123520':16A,19A '-2026':15A,18A '0.18.0':89C '2.7.1':91C 'account':114C 'add':42B,120C 'admin':61B,103C 'allow':84B,98C 'attack':59B,76B,115C 'bot':13A,41B,119C,130C 'contain':92C 'control':78B 'creat':39B,117C 'cve':14A,17A 'delet':12A,48B,113C,126C 'endpoint':131C 'ensureprojectadminus':133C 'escal':95C 'gain':60B,102C 'host':23B,32B 'let':35B 'lock':66B,141C 'manag':34B 'owner':3A,38B,70B,100C,145C 'ownership':63B,105C 'privileg':94C 'project':10A,56B,80B,111C 'promot':51B,135C 'read':7A,53B,108C,137C 'read-on':6A,52B,107C,136C 'real':69B,144C 'result':72B 'runtim':20B 'seiz':5A 'self':22B,31B 'self-host':21B,30B 'share':9A,26B,55B,110C,139C 'take':77B 'task':33B 'team':2A,25B,37B,46B,99C,124C 'team-shar':24B 'trigger':132C 'view':86B 'vikunja':1A,27B,28B,87C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Vikunja from 0.18.0 up to but not including 2.7.1 that share projects read-only with other users. Instances on 2.7.1 or later, or with no team sharing, are not exposed. The sources do not say whether managed hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","runtime","selfhosted","teamsharing","vikunja"],"campaign_type":null,"search_a":"'-123520':16A,19A '-2026':15A,18A 'bot':13A 'cve':14A,17A 'delet':12A 'owner':3A 'project':10A 'read':7A 'read-on':6A 'seiz':5A 'share':9A 'team':2A 'vikunja':1A","search_b":"'add':42B 'admin':61B 'allow':84B 'attack':59B,76B 'bot':41B 'control':78B 'creat':39B 'delet':48B 'gain':60B 'host':23B,32B 'let':35B 'lock':66B 'manag':34B 'owner':38B,70B 'ownership':63B 'project':56B,80B 'promot':51B 'read':53B 'read-on':52B 'real':69B 'result':72B 'runtim':20B 'self':22B,31B 'self-host':21B,30B 'share':26B,55B 'take':77B 'task':33B 'team':25B,37B,46B 'team-shar':24B 'view':86B 'vikunja':27B,28B","search_c":"'0.18.0':89C '2.7.1':91C 'account':114C 'add':120C 'admin':103C 'allow':98C 'attack':115C 'bot':119C,130C 'contain':92C 'creat':117C 'delet':113C,126C 'endpoint':131C 'ensureprojectadminus':133C 'escal':95C 'gain':102C 'lock':141C 'owner':100C,145C 'ownership':105C 'privileg':94C 'project':111C 'promot':135C 'read':108C,137C 'read-on':107C,136C 'real':144C 'share':110C,139C 'team':99C,124C 'trigger':132C 'vikunja':87C 'vulner':96C","first_public_at":"2026-10-22T10:06:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123520","severity":null,"published_at":"2026-11-08T02:16:41+00:00","modified_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99189,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hq66-9qg8-jwqg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:06:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99190,"url":"https://www.vulncheck.com/advisories/vikunja-0.18.0-before-2.7.1-privilege-escalation-via-account-deletion","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}