CVE-2026-123522 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 lets an authenticated user send a crafted task object during a no-op Kanban bucket move, pointing the task ID at a victim's task. The attacker can then read the full contents of that task through their own webhook and forge mention notifications.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any Vikunja instance before 2.7.1 where users have accounts and can move tasks on Kanban boards. Exposure is greatest where webhooks are used, since task contents are routed to an attacker-chosen endpoint. Instances on 2.7.1 or later, or with no user accounts beyond trusted staff, are lower risk.
Not affected if fixed-version, no-webhooks
Who cares kanban, self-hosted, vikunja, webhooks
2.7.1 are affected.2.7.1 or later.Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.