PT-2026-139785
CVE-2026-123504
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Vikunja versions 0.22.0 through 2.7.0
Description
An information disclosure issue allows read-only project members to view full webhook target URLs when listing project webhooks. This allows attackers to extract API keys or incoming-webhook tokens embedded within the
target url values, which can then be used to post to receiving channels or reused until the keys are rotated.Recommendations
Update to version 2.7.1.
Found an issue in the description? Have something to add? Feel free to write us 👾