Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123504Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members
Medium 4.3
In plain English
A medium-severity information exposure in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0.22.0 – before 2.7.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-586f-48mj-3rwr) vendor-advisory
- VulnCheck Advisory: Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members third-party-advisory