Privilege Escalation Vulnerability in Vikunja by Vikunja Team

CVE-2026-123520

What is CVE-2026-123520?

Vikunja versions prior to 2.7.1 are susceptible to a privilege escalation flaw that permits team owners to seize admin rights or ownership over read-only projects. This is accomplished by the unauthorized deletion of accounts, which allows an attacker to create a bot, include it within a team, and subsequently delete it using the bots endpoint. This action triggers a function to promote read-only shares, effectively locking out legitimate owners from their projects. Such vulnerabilities can lead to serious disruptions in team and project management.

References