CVE-2026-91980

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0

Description Authenticated users can enumerate all teams and members because the software fails to validate team access when attaching teams to projects. By sending arbitrary team IDs to the project teams endpoint, an attacker can retrieve complete team rosters, including member names and admin flags for teams they are not authorized to access.

Recommendations Update vikunja to version 2.6.0 or later.