Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123520Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion
High 7.1
In plain English
A high-severity privilege mismanagement in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering ensureProjectAdminUser to promote read-only shares and lock out the real owner.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0.18.0 – before 2.7.1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
References
- GitHub Security Advisory (GHSA-hq66-9qg8-jwqg) vendor-advisory
- VulnCheck Advisory: Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion third-party-advisory