{"id":"CVE-2026-123526","kind":"vulnerability","aliases":["CVE-2026-123526"],"related":[],"title":"Vikunja: any signed-in user can mark a team as externally managed","description":"Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.","summary":"Vikunja before 2.7.1 lets any authenticated user set a read-only external_id field on teams through the team create and update endpoints. An attacker can lock every member out of removal and cause SSO members to be dropped from the team at their next login.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","sso","vikunja"],"not_affected_if":["instance-on-2.7.1","managed-hosting"],"how_to_check":"- Check the Vikunja version in use; versions below `2.7.1` are affected.\n- Look for teams with a non-empty external_id that no SSO integration manages.","fix":"- Vikunja: upgrade to `2.7.1`","status":"open","published_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:25:12+00:00","updated_at":"2026-11-08T02:25:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:12Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: upgrade to `2.7.1`","reach":"network","title":"Vikunja: any signed-in user can mark a team as externally managed","impact":"medium","summary":"Vikunja before 2.7.1 lets any authenticated user set a read-only external_id field on teams through the team create and update endpoints. An attacker can lock every member out of removal and cause SSO members to be dropped from the team at their next login.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","sso"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Team membership becomes locked and SSO members are removed at login","analyst_note":"","how_to_check":"- Check the Vikunja version in use; versions below `2.7.1` are affected.\n- Look for teams with a non-empty external_id that no SSO integration manages.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","instance-on-2.7.1"],"who_is_affected":"Teams running a self-hosted Vikunja instance before 2.7.1 where users can create or edit teams. Exposure requires a valid account on that instance; sources do not say whether SSO is required for the team-level effect.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":4273,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123526':16A,19A '-2026':15A,18A '2.7.1':28B,75C 'administ':110C 'allow':82C 'assign':79C 'attack':51B,102C 'authent':31B,84C 'block':115C 'caus':60B,121C 'contain':76C 'creat':46B,98C,108C 'cve':14A,17A 'drop':65B,126C 'endpoint':49B,101C 'everi':54B,118C 'extern':12A,38B,92C,112C 'field':40B,94C 'host':23B 'id':39B,93C 'let':29B 'lock':53B 'login':72B,133C 'manag':13A,113C 'mark':8A 'mass':78C 'member':55B,62B,119C,123C 'next':71B,132C 'packag':20B 'perman':114C 'read':36B,90C 'read-on':35B,89C 'remov':58B,116C 'self':22B 'self-host':21B 'set':33B,87C 'sign':4A 'signed-in':3A 'sso':24B,61B,122C 'tag':104C 'team':10A,42B,45B,68B,97C,106C,129C 'updat':48B,100C 'user':6A,32B,85C 'vikunja':1A,25B,26B,73C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Vikunja instance before 2.7.1 where users can create or edit teams. Exposure requires a valid account on that instance; sources do not say whether SSO is required for the team-level effect.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","sso","vikunja"],"campaign_type":null,"search_a":"'-123526':16A,19A '-2026':15A,18A 'cve':14A,17A 'extern':12A 'manag':13A 'mark':8A 'sign':4A 'signed-in':3A 'team':10A 'user':6A 'vikunja':1A","search_b":"'2.7.1':28B 'attack':51B 'authent':31B 'caus':60B 'creat':46B 'drop':65B 'endpoint':49B 'everi':54B 'extern':38B 'field':40B 'host':23B 'id':39B 'let':29B 'lock':53B 'login':72B 'member':55B,62B 'next':71B 'packag':20B 'read':36B 'read-on':35B 'remov':58B 'self':22B 'self-host':21B 'set':33B 'sso':24B,61B 'team':42B,45B,68B 'updat':48B 'user':32B 'vikunja':25B,26B","search_c":"'2.7.1':75C 'administ':110C 'allow':82C 'assign':79C 'attack':102C 'authent':84C 'block':115C 'caus':121C 'contain':76C 'creat':98C,108C 'drop':126C 'endpoint':101C 'everi':118C 'extern':92C,112C 'field':94C 'id':93C 'login':133C 'manag':113C 'mass':78C 'member':119C,123C 'next':132C 'perman':114C 'read':90C 'read-on':89C 'remov':116C 'set':87C 'sso':122C 'tag':104C 'team':97C,106C,129C 'updat':100C 'user':85C 'vikunja':73C 'vulner':80C","first_public_at":"2026-10-22T10:07:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123526","severity":null,"published_at":"2026-11-08T02:16:42+00:00","modified_at":"2026-11-08T02:16:42+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99201,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:07:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99202,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-mass-assignment-via-team-external-id-field","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}