Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-123526 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g	[email protected]	AdvisoryExploitRemedyVendor
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-mass-assignment-via-team-external-id-field	[email protected]	AdvisoryVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	[email protected]

Affected Products

Product	Versions
Vikunja	<= 2.7.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 2.7.1moderate effort Workaround:moderate effort Delete any affected teams to recover from the vulnerability, but note that this will also remove all project shares associated with those teams. Mitigation:moderate effort Reject requests that attempt to set a non-empty `external_id` for teams at the reverse proxy.

Product

Versions

Vikunja

<= 2.7.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 2.7.1moderate effort
Workaround:moderate effort
Delete any affected teams to recover from the vulnerability, but note that this will also remove all project shares associated with those teams.
Mitigation:moderate effort
Reject requests that attempt to set a non-empty `external_id` for teams at the reverse proxy.

Change History

1 change record found show changes