---
id: "CVE-2026-123524"
page: "https://infrastack.ai/live/CVE-2026-123524"
kind: "vulnerability"
aliases: ["CVE-2026-123524"]
title: "Vikunja: webhooks leak tasks from private projects to collaborators"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikunja", "webhooks"]
not_affected_if: ["no-webhooks", "single-user-projects", "versions-2.7.1-or-later"]
published_at: "2026-11-08T02:16:41+00:00"
first_seen_at: "2026-11-08T02:21:09+00:00"
updated_at: "2026-11-08T02:24:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123524", "first_seen_at": "2026-11-08T02:21:09+00:00"}]
exploit_sources: []
---

# Vikunja: webhooks leak tasks from private projects to collaborators

Link for people: https://infrastack.ai/live/CVE-2026-123524 (this .md is for agents)

Vikunja, a self-hosted task manager, sends webhook payloads built with the triggering user's permissions rather than the webhook owner's. A project collaborator with write access can register a webhook and receive titles, descriptions and metadata of tasks in private projects they cannot open.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Vikunja version, for example with `vikunja version` or the About page in the web UI.
- Review who has write access to projects and whether any webhooks are registered on shared projects.
- Confirm that webhooks are in use at all; the sources do not give a config flag.

## Fix

- Upgrade Vikunja to `2.7.1` or later, per the sources.

## Timeline

- 2026-11-08T02:21:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123524

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-66cq-j6rw-pjch
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-0.23.0-before-2.7.1-information-disclosure-via-webhook-related-tasks-payload

## From the sources

Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_