CVE-2026-123526 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 lets any authenticated user set a read-only external_id field on teams through the team create and update endpoints. An attacker can lock every member out of removal and cause SSO members to be dropped from the team at their next login.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted Vikunja instance before 2.7.1 where users can create or edit teams. Exposure requires a valid account on that instance; sources do not say whether SSO is required for the team-level effect.
Not affected if instance-on-2.7.1, managed-hosting
Who cares self-hosted, sso, vikunja
2.7.1 are affected.2.7.1Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.