CVE-2026-123517 Details
Description
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.
An information disclosure vulnerability has been identified in Vikunja versions prior to 2.7.1. This vulnerability allows authenticated users to determine the existence of private teams by using the team member self-removal endpoint. By sending DELETE requests to the endpoint for various team IDs, users can receive responses that indicate whether a team exists, if it is managed through Single Sign-On (SSO), or if it has only one member. The vulnerability arises because the application does not properly verify team membership before allowing the deletion of team member entries.
Users can upgrade to Vikunja version 2.7.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |