high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-123522

Vikunja versions prior to 2.7.1 allow an authenticated user to read any task by injecting a crafted task object into a no‑op Kanban bucket m

Overview

Vikunja versions prior to 2.7.1 allow an authenticated user to read any task by injecting a crafted task object into a no‑op Kanban bucket move. The vulnerability enables the attacker to retrieve full task contents via a webhook and forge mention notifications. This flaw exposes sensitive task data to unauthorized users.

Description

Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications.

Impact

The flaw compromises confidentiality by permitting any authenticated user to read tasks belonging to other projects. Project owners, administrators, and regular users are at risk of having their task details exposed. The vulnerability does not affect integrity or availability directly.

Remediation

Upgrade to Vikunja 2.7.1 or later to receive the fix that validates task.project_id during bucket moves. If an upgrade is not immediately possible, disable or restrict the no‑op Kanban bucket move feature and review webhook permissions to ensure they only receive data from authorized projects.

Risk context

The CVSS v3 score of 7.1 and high severity rating indicate a significant risk that should be addressed promptly, though no EPSS data is available. Defenders should treat this as a high‑priority issue and apply the patch as soon as feasible.

Affected products

  • Vikunja 2.x

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

authorization-bypass task-read webhook Vikunja confidentiality high-severity

← All CVEs

Related CVEs

high

CVE-2026-99277

In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.

View analysis

high

CVE-2026-123497

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

View analysis

high

CVE-2026-123501

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.

View analysis

high

CVE-2026-123512

Vikunja versions prior to 2.7.1 expose password-reset, email-confirmation, and account-deletion tokens in URLs that are logged, allowing attackers with log access to replay tokens and compromise accounts. This flaw can lead to unauthorized account takeover or deletion. Defenders should update or patch the application immediately.

View analysis