Information Disclosure Vulnerability in Vikunja by Vikunja, Inc.

CVE-2026-123524

What is CVE-2026-123524?

Vikunja is susceptible to an information disclosure vulnerability that permits project collaborators with write access to gain unauthorized visibility into tasks from private projects. This occurs through the registration of webhooks, where payloads are generated based on the permissions of the triggering user. As a result, attackers can access sensitive details, including task titles, descriptions, and related metadata from private projects whenever a linked task is modified by another user.

References