CVE-2026-123524

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.23.0 through 2.7.0

Description An information disclosure issue exists where project collaborators with write access can read tasks from inaccessible projects by registering webhooks. This occurs because webhook payloads are constructed using the permissions of the user who triggers the event. Consequently, when another user modifies a linked task, attackers can obtain titles, descriptions, and metadata of related tasks from private projects.

Recommendations Update to version 2.7.1.