CVE-2026-123522: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.projectid to their own project, routing full task contents to their webhook and forging mention notifications.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated Vikunja user. The issue lets that user target tasks they would not normally be authorized to read.

What access or setup does an attacker need?

The attacker needs control of a project and a webhook that can receive the task contents. They exploit the issue by submitting a no-op Kanban bucket move with a crafted task object whose task ID identifies the victim task and whose project ID identifies the attacker’s project.

What information can be exposed or actions can be triggered?

A successful attack can route the full contents of an arbitrary task to the attacker’s webhook. It can also forge mention notifications.

Which versions are affected?

Vikunja versions before 2.7.1 are affected. The provided information does not identify any configuration prerequisite or mitigation other than moving to version 2.7.1 or later.

CVE-2026-123522: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or setup does an attacker need?

What information can be exposed or actions can be triggered?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or setup does an attacker need?

What information can be exposed or actions can be triggered?

Which versions are affected?