GHSA-5q33-h98p-rgh9: Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.projectid to their own project, routing full task contents to their webhook and forging mention notifications.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be an authenticated Vikunja user and must have a project of their own. They exploit the issue by submitting a crafted task object during a no-op Kanban bucket move.

What information or actions can the attacker obtain?

The crafted request can cause the full contents of an arbitrary victim task to be sent to the attacker’s webhook. The attacker can also forge mention notifications.

Which versions should be remediated?

Vikunja versions before 2.7.1 are affected. Upgrading to 2.7.1 or later addresses the affected version range described.

GHSA-5q33-h98p-rgh9: Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What information or actions can the attacker obtain?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What information or actions can the attacker obtain?

Which versions should be remediated?