Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123506Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
Medium 5.4
In plain English
A medium-severity incorrect authorization in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 2.2.0 – before 2.7.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-5f6v-j6xm-wwj9) vendor-advisory
- VulnCheck Advisory: Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints third-party-advisory