CVE-2026-91980: vikunja before 2.6.0 Team Enumeration via Project Share
Published Sep 15, 2026
·Updated
vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams.
Affected Software
1 affected component
Vikunja<2.6.0
Event History
Sep 15, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated Vikunja user with the ability to use the project teams endpoint can exploit it. No user interaction is required.
2
What information can an attacker obtain?
An attacker can attach arbitrary team IDs to projects and retrieve rosters for teams they are not authorized to access, including member names and administrator flags.
3
Which versions are affected?
Vikunja versions before 2.6.0 are affected.