Team Enumeration Vulnerability in Vikunja by Go Vikunja

CVE-2026-91980

What is CVE-2026-91980?

Vikunja versions prior to 2.6.0 contain a vulnerability that fails to sufficiently validate team access when linking teams to projects. This flaw permits authenticated users to exploit the project teams endpoint, enabling them to attach arbitrary team IDs. Subsequently, they can enumerate all teams and their members, including sensitive data such as member names and administrative privileges of unauthorized teams. This vulnerability presents significant risks for data privacy and security within the application.

References