---
id: "CVE-2026-123526"
page: "https://infrastack.ai/live/CVE-2026-123526"
kind: "vulnerability"
aliases: ["CVE-2026-123526"]
title: "Vikunja: any signed-in user can mark a team as externally managed"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "sso", "vikunja"]
not_affected_if: ["instance-on-2.7.1", "managed-hosting"]
published_at: "2026-11-08T02:16:42+00:00"
first_seen_at: "2026-11-08T02:21:09+00:00"
updated_at: "2026-11-08T02:25:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123526", "first_seen_at": "2026-11-08T02:21:09+00:00"}]
exploit_sources: []
---

# Vikunja: any signed-in user can mark a team as externally managed

Link for people: https://infrastack.ai/live/CVE-2026-123526 (this .md is for agents)

Vikunja before 2.7.1 lets any authenticated user set a read-only external_id field on teams through the team create and update endpoints. An attacker can lock every member out of removal and cause SSO members to be dropped from the team at their next login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version in use; versions below `2.7.1` are affected.
- Look for teams with a non-empty external_id that no SSO integration manages.

## Fix

- Vikunja: upgrade to `2.7.1`

## Timeline

- 2026-11-08T02:21:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123526

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-mass-assignment-via-team-external-id-field

## From the sources

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_