CVE-2026-111919: Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects are exposed if a collaborator created a webhook and was later removed from the project. That former collaborator may continue receiving task titles and descriptions, including content created after their access was revoked.
What does an attacker need to exploit it?
The attacker needs prior collaborator access to the project and must have created a webhook before their access is removed. No further interaction is required for them to receive data delivered to that webhook.
Are deployments running older versions affected?
The affected range is Vikunja 0.22.0 before 2.7.0. Deployments in that range should identify webhooks created by removed collaborators and treat data sent through those endpoints as potentially disclosed.