Live › vulnerability › CVE-2026-91980
Go to dashboardVikunja's Go API module lets any logged-in user attach arbitrary teams to a project they create, which exposes every team and its member list. An attacker gets the names and membership of all teams on the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| code.vikunja.io/api | go | all versions | – |
Check the Go module version in go.mod for code.vikunja.io/api; versions before v2.6.0 are affected.
Upgrade code.vikunja.io/api to v2.6.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91980")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.