CVE-2026-123506

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.2.0 through 2.7.0

Description An authorization bypass exists that allows users with tokens scoped only to projects webhooks to manage user-level webhooks of the owner. This is achieved by supplying the user id variable in request bodies. An attacker can register user webhooks to their own receiver to intercept reminders and task payloads from all projects belonging to the owner, as well as read, modify, or delete existing user webhooks.

Recommendations Update to version 2.7.1.