CVE-2026-123520

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.18.0 through 2.7.0

Description A privilege escalation issue allows team owners to obtain administrative rights or ownership of read-only shared projects. An attacker can achieve this by creating a bot, adding it to their team, and then deleting it via the bots endpoint. This process triggers the ensureProjectAdminUser() function, which promotes read-only shares and locks out the actual owner.

Recommendations Update to version 2.7.1.