Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123517Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint
Medium 4.3
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-v3r6-33v3-79c2) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint third-party-advisory