Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123499Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
Medium 5.9
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
References
- GitHub Security Advisory (GHSA-3rrq-h284-5vpx) vendor-advisory
- VulnCheck Advisory: Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server third-party-advisory