CVE-2026-123504: Infoleak
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in targeturl values to post to receiving channels or reuse keys until rotated.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A read-only member of a Vikunja project can exploit it if that project has webhooks configured. The member can list the project webhooks and view the full target URLs.
What secrets may be exposed?
Incoming-webhook tokens and API keys embedded in webhook target_url values may be disclosed. An attacker could use those values to post to receiving channels or reuse the keys until they are rotated.
What should be done if exposure is suspected?
Rotate any incoming-webhook tokens or API keys embedded in affected webhook target URLs. This limits reuse of credentials that may already have been viewed by read-only project members.