Live › vulnerability › GHSA-hjx8-qv73-f7cm
Go to dashboardVikunja's API keeps webhooks and link shares active after the sharing user is removed or the share is revoked through the normal paths. A former collaborator can keep receiving task data or accessing the shared project feed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | >= 0.22.0 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api
This page as .md · .json · in your agent: get_signal("GHSA-hjx8-qv73-f7cm")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.