Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123524Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload
Medium 5.7
In plain English
A medium-severity incorrect authorization in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0.23.0 – before 2.7.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N