Authorization Bypass in Vikunja Task Management Software by Vikunja
CVE-2026-123522

7.1HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123522?

An authorization bypass vulnerability exists in Vikunja versions prior to 2.7.1, enabling authenticated users to read unrestricted task details. This flaw allows the insertion of a manipulated task object into a no-op Kanban bucket move. As a result, attackers can specify the task ID to access victim tasks and link them to their own project, thereby receiving complete task information through their webhook along with forged mention notifications. This vulnerability poses a significant risk to sensitive task data and requires immediate attention.

Affected Version(s)

vikunja 0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M7Saad
.