{"id":"CVE-2026-123524","kind":"vulnerability","aliases":["CVE-2026-123524"],"related":[],"title":"Vikunja: webhooks leak tasks from private projects to collaborators","description":"Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.","summary":"Vikunja, a self-hosted task manager, sends webhook payloads built with the triggering user's permissions rather than the webhook owner's. A project collaborator with write access can register a webhook and receive titles, descriptions and metadata of tasks in private projects they cannot open.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja","webhooks"],"not_affected_if":["no-webhooks","single-user-projects","versions-2.7.1-or-later"],"how_to_check":"- Check the running Vikunja version, for example with `vikunja version` or the About page in the web UI.\n- Review who has write access to projects and whether any webhooks are registered on shared projects.\n- Confirm that webhooks are in use at all; the sources do not give a config flag.","fix":"- Upgrade Vikunja to `2.7.1` or later, per the sources.","status":"open","published_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:24:45+00:00","updated_at":"2026-11-08T02:24:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.1` or later, per the sources.","reach":"network","title":"Vikunja: webhooks leak tasks from private projects to collaborators","impact":"medium","summary":"Vikunja, a self-hosted task manager, sends webhook payloads built with the triggering user's permissions rather than the webhook owner's. A project collaborator with write access can register a webhook and receive titles, descriptions and metadata of tasks in private projects they cannot open.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","webhooks"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Collaborators read task titles and descriptions from private projects.","analyst_note":"","how_to_check":"- Check the running Vikunja version, for example with `vikunja version` or the About page in the web UI.\n- Review who has write access to projects and whether any webhooks are registered on shared projects.\n- Confirm that webhooks are in use at all; the sources do not give a config flag.","plain_action":"","needs_analyst":false,"not_affected_if":["no-webhooks","single-user-projects","versions-2.7.1-or-later"],"who_is_affected":"Teams that self-host Vikunja 0.23.0 up to but not including 2.7.1 and use webhooks on shared projects. The exposure needs an account with write access to a project, and the leak is reached through the webhook payload when another user changes a linked task. Instances without webhooks or with only single-user projects are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4295,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123524':12A,15A '-2026':11A,14A '0.23.0':71C '2.7.1':73C 'access':50B,85C 'allow':80C 'anoth':118C 'attack':106C 'built':32B,99C 'cannot':67B 'collabor':9A,47B,82C 'contain':74C 'cve':10A,13A 'descript':58B,111C 'disclosur':77C 'host':19B,26B 'inaccess':90C 'inform':76C 'leak':3A 'link':122C 'manag':28B 'metadata':60B,113C 'modifi':120C 'open':68B 'owner':43B 'packag':16B 'payload':31B,97C 'permiss':38B,105C 'privat':6A,64B,115C 'project':7A,46B,65B,81C,91C,116C 'rather':39B 'read':87C 'receiv':56B,107C 'regist':52B,93C 'relat':108C 'self':18B,25B 'self-host':17B,24B 'send':29B 'task':4A,27B,62B,88C,109C,123C 'titl':57B,110C 'trigger':35B,102C 'user':36B,103C,119C 'vikunja':1A,20B,22B,69C 'vulner':78C 'webhook':2A,21B,30B,42B,54B,94C,96C 'whenev':117C 'write':49B,84C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja 0.23.0 up to but not including 2.7.1 and use webhooks on shared projects. The exposure needs an account with write access to a project, and the leak is reached through the webhook payload when another user changes a linked task. Instances without webhooks or with only single-user projects are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vikunja","webhooks"],"campaign_type":null,"search_a":"'-123524':12A,15A '-2026':11A,14A 'collabor':9A 'cve':10A,13A 'leak':3A 'privat':6A 'project':7A 'task':4A 'vikunja':1A 'webhook':2A","search_b":"'access':50B 'built':32B 'cannot':67B 'collabor':47B 'descript':58B 'host':19B,26B 'manag':28B 'metadata':60B 'open':68B 'owner':43B 'packag':16B 'payload':31B 'permiss':38B 'privat':64B 'project':46B,65B 'rather':39B 'receiv':56B 'regist':52B 'self':18B,25B 'self-host':17B,24B 'send':29B 'task':27B,62B 'titl':57B 'trigger':35B 'user':36B 'vikunja':20B,22B 'webhook':21B,30B,42B,54B 'write':49B","search_c":"'0.23.0':71C '2.7.1':73C 'access':85C 'allow':80C 'anoth':118C 'attack':106C 'built':99C 'collabor':82C 'contain':74C 'descript':111C 'disclosur':77C 'inaccess':90C 'inform':76C 'link':122C 'metadata':113C 'modifi':120C 'payload':97C 'permiss':105C 'privat':115C 'project':81C,91C,116C 'read':87C 'receiv':107C 'regist':93C 'relat':108C 'task':88C,109C,123C 'titl':110C 'trigger':102C 'user':103C,119C 'vikunja':69C 'vulner':78C 'webhook':94C,96C 'whenev':117C 'write':84C","first_public_at":"2026-10-22T10:07:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123524","severity":null,"published_at":"2026-11-08T02:16:41+00:00","modified_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99197,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-66cq-j6rw-pjch","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:07:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99198,"url":"https://www.vulncheck.com/advisories/vikunja-0.23.0-before-2.7.1-information-disclosure-via-webhook-related-tasks-payload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}