CVE-2026-123524 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, a self-hosted task manager, sends webhook payloads built with the triggering user's permissions rather than the webhook owner's. A project collaborator with write access can register a webhook and receive titles, descriptions and metadata of tasks in private projects they cannot open.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja 0.23.0 up to but not including 2.7.1 and use webhooks on shared projects. The exposure needs an account with write access to a project, and the leak is reached through the webhook payload when another user changes a linked task. Instances without webhooks or with only single-user projects are unlikely to be exposed.
Not affected if no-webhooks, single-user-projects, versions-2.7.1-or-later
Who cares self-hosted, vikunja, webhooks
vikunja version or the About page in the web UI.2.7.1 or later, per the sources.Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.