GHSA-586f-48mj-3rwr: Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members
Published Nov 8, 2026
·Updated
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in targeturl values to post to receiving channels or reuse keys until rotated.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Nov 8, 2026
CVE Published
via OSV·01:37 AM
Data Sourced
via OSV·01:37 AM
DescriptionSeverityWeakness