CVE-2026-123506

MediumCVSS 5.4/10Last modified Nov 9, 2026

Description

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1235072.7Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by savin CVE-2026-1235083.1Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable CVE-2026-1235094.3Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimi CVE-2026-123519.8IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 cou CVE-2026-1235103.3Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in CVE-2026-1235114.3Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounde CVE-2026-1235126.1Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so CVE-2026-1235136.8Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to swi CVE-2026-1235144.3Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exp CVE-2026-1235154.1Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients reque CVE-2026-1235164.3Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consum CVE-2026-1235174.3Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exi