PT-2026-116488

CVE-2026-111919

Published

2026-10-09

Updated

2026-10-19

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.22.0 through 2.6.x

Description An improper access revocation issue allows removed collaborators to continue receiving project data via webhooks they previously created. This results in former collaborators receiving task titles and descriptions, including information generated after their access was revoked.

Recommendations Update to version 2.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Euriconicacio

Tan-Junwei

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization