CVE-2026-123526: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only externalid field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Vikunja user can exploit it through the team create or update endpoints, provided they can create a team or administer an existing team.

What is the operational impact after a team is marked as externally managed?

Removal of every member from that team is permanently blocked. SSO members are also dropped from the team the next time they log in.

Are teams affected only if an attacker can administer them?

An attacker can mark a team they create as externally managed, or do the same to an existing team they administer. The provided information does not indicate that users without those permissions can alter another team's external_id.

CVE-2026-123526: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact after a team is marked as externally managed?

Are teams affected only if an attacker can administer them?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact after a team is marked as externally managed?

Are teams affected only if an attacker can administer them?