CVE-2026-123526

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description An issue exists where authenticated users can manipulate the read-only external id field via the team create and update endpoints. This mass assignment allows attackers to mark a team they create or manage as externally managed, which prevents the removal of team members and causes users authenticated via Single Sign-On (SSO) to be removed from the team during their next login.

Recommendations Update to version 2.7.1.