{"id":"GHSA-hjx8-qv73-f7cm","kind":"vulnerability","aliases":["GHSA-hjx8-qv73-f7cm","GO-2026-6733"],"related":[],"title":"Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api","description":"Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api","summary":"Vikunja's API keeps webhooks and link shares active after the sharing user is removed or the share is revoked through the normal paths. A former collaborator can keep receiving task data or accessing the shared project feed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":">= 0.22.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["no-link-shares-or-webhooks-used","version-below-0.22.0"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:26+00:00","updated_at":"2026-10-23T20:15:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Vikunja's API keeps webhooks and link shares active after the sharing user is removed or the share is revoked through the normal paths. A former collaborator can keep receiving task data or accessing the shared project feed.","category":"package","who_cares":["vikunja","go","self-hosted"],"confidence":0.6,"analyst_note":"Sources give no fixed version, severity or check steps; read https://pkg.go.dev/vuln/GO-2026-6733 and the GHSA advisory for the fixed release and remediation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-below-0.22.0","no-link-shares-or-webhooks-used"],"severity_if_unknown":"unknown"},"cost_usd":0.000332,"input_tokens":2020,"output_tokens":260,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':28A '-6733':29A '/api':21A,37A,102C 'access':77B 'activ':52B 'api':46B 'code.vikunja.io':20A,36A,101C 'code.vikunja.io/api':19A,35A,100C 'collabor':13A,70B,94C 'data':75B 'everi':7A,88C 'f7cm':26A,34A 'feed':17A,81B,98C 'former':69B 'ghsa':23A,31A 'ghsa-hjx8-qv73-f7cm':22A,30A 'go':27A,38B 'hjx8':24A,32A 'host':42B 'keep':14A,47B,72B,95C 'link':4A,50B,85C 'live':16A,97C 'normal':66B 'packag':39B 'path':9A,67B,90C 'project':80B 'qv73':25A,33A 'receiv':73B 'remov':12A,58B,93C 'revoc':8A,89C 'revok':63B 'self':41B 'self-host':40B 'share':5A,51B,55B,61B,79B,86C 'surviv':6A,87C 'task':74B 'user':56B 'vikunja':1A,43B,44B,82C 'webhook':2A,48B,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6733","url":"https://pkg.go.dev/vuln/GO-2026-6733","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}