CVE-2026-123506 Details
Description
Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.
An authorization bypass vulnerability has been identified in Vikunja versions 2.2.0 prior to 2.7.1. This vulnerability allows users with tokens limited to project webhooks to manipulate the owner's user-level webhooks by including a user_id in the request body. Exploitation of this vulnerability enables the registration of user webhooks to the attacker's receiver, facilitating the retrieval of reminders and task data from all owner projects. Additionally, it allows for reading, modifying, or deleting existing user webhooks.
Users can update to Vikunja version 2.7.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5f6v-j6xm-wwj9 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-token-scope-bypass-via-project-webhook-endpoints | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | >= 2.2.0, <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |