{"id":"CVE-2026-123522","kind":"vulnerability","aliases":["CVE-2026-123522"],"related":[],"title":"Vikunja: crafted Kanban move lets logged-in users read any task","description":"Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications.","summary":"Vikunja before 2.7.1 lets an authenticated user send a crafted task object during a no-op Kanban bucket move, pointing the task ID at a victim's task. The attacker can then read the full contents of that task through their own webhook and forge mention notifications.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kanban","package","self-hosted","vikunja","webhooks"],"not_affected_if":["fixed-version","no-webhooks"],"how_to_check":"- Check the Vikunja version in use; versions before `2.7.1` are affected.\n- Confirm whether webhooks are configured on projects that users can move tasks in.","fix":"- Upgrade Vikunja to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:29+00:00","updated_at":"2026-11-08T02:23:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.1` or later.","reach":"network","title":"Vikunja: crafted Kanban move lets logged-in users read any task","impact":"medium","summary":"Vikunja before 2.7.1 lets an authenticated user send a crafted task object during a no-op Kanban bucket move, pointing the task ID at a victim's task. The attacker can then read the full contents of that task through their own webhook and forge mention notifications.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","kanban","webhooks"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user reads any task's full contents and forges mentions","analyst_note":"","how_to_check":"- Check the Vikunja version in use; versions before `2.7.1` are affected.\n- Confirm whether webhooks are configured on projects that users can move tasks in.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-webhooks"],"who_is_affected":"Any Vikunja instance before 2.7.1 where users have accounts and can move tasks on Kanban boards. Exposure is greatest where webhooks are used, since task contents are routed to an attacker-chosen endpoint. Instances on `2.7.1` or later, or with no user accounts beyond trusted staff, are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":4274,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123522':15A,18A '-2026':14A,17A '2.7.1':28B,76C 'allow':83C 'attack':56B,104C 'authent':31B,84C 'author':79C 'bucket':44B,102C 'bypass':80C 'contain':77C 'content':62B,122C 'craft':2A,35B,93C 'cve':13A,16A 'forg':71B,127C 'full':61B,120C 'host':23B 'id':49B,114C 'inject':91C 'kanban':3A,19B,43B,101C 'let':5A,29B 'log':7A 'logged-in':6A 'mention':72B,128C 'move':4A,45B,103C 'no-op':40B,98C 'notif':73B,129C 'object':37B,95C 'op':42B,100C 'packag':20B 'point':46B 'project':118C 'read':10A,59B,87C 'rout':119C 'self':22B 'self-host':21B 'send':33B 'set':106C 'task':12A,36B,48B,54B,65B,89C,94C,111C,121C 'task.id':107C 'task.project':113C 'user':9A,32B,85C 'victim':52B,110C 'vikunja':1A,24B,26B,74C 'vulner':81C 'webhook':25B,69B,125C","nicknames":[],"mitigations":[],"who_affected":"Any Vikunja instance before 2.7.1 where users have accounts and can move tasks on Kanban boards. Exposure is greatest where webhooks are used, since task contents are routed to an attacker-chosen endpoint. Instances on `2.7.1` or later, or with no user accounts beyond trusted staff, are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kanban","package","selfhosted","vikunja","webhooks"],"campaign_type":null,"search_a":"'-123522':15A,18A '-2026':14A,17A 'craft':2A 'cve':13A,16A 'kanban':3A 'let':5A 'log':7A 'logged-in':6A 'move':4A 'read':10A 'task':12A 'user':9A 'vikunja':1A","search_b":"'2.7.1':28B 'attack':56B 'authent':31B 'bucket':44B 'content':62B 'craft':35B 'forg':71B 'full':61B 'host':23B 'id':49B 'kanban':19B,43B 'let':29B 'mention':72B 'move':45B 'no-op':40B 'notif':73B 'object':37B 'op':42B 'packag':20B 'point':46B 'read':59B 'self':22B 'self-host':21B 'send':33B 'task':36B,48B,54B,65B 'user':32B 'victim':52B 'vikunja':24B,26B 'webhook':25B,69B","search_c":"'2.7.1':76C 'allow':83C 'attack':104C 'authent':84C 'author':79C 'bucket':102C 'bypass':80C 'contain':77C 'content':122C 'craft':93C 'forg':127C 'full':120C 'id':114C 'inject':91C 'kanban':101C 'mention':128C 'move':103C 'no-op':98C 'notif':129C 'object':95C 'op':100C 'project':118C 'read':87C 'rout':119C 'set':106C 'task':89C,94C,111C,121C 'task.id':107C 'task.project':113C 'user':85C 'victim':110C 'vikunja':74C 'vulner':81C 'webhook':125C","first_public_at":"2026-10-22T10:07:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123522","severity":null,"published_at":"2026-11-08T02:16:41+00:00","modified_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99193,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5q33-h98p-rgh9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:07:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99194,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-task-information-disclosure-via-kanban-bucket-move-webhook","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}