GHSA-fjrf-gjmg-9v6g: Vikunja before 2.7.1 Mass Assignment via Team external_id Field
Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only externalid field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Vikunja user can exploit it against a team they create or administer, using the team creation or update endpoints.
What is the operational impact after a team is marked as externally managed?
Removal of every team member is permanently blocked. SSO members are also dropped from the team when they next log in.
Which versions are affected?
Vikunja versions before 2.7.1 are affected.