CVE-2026-123506
Deferred Deferred - Pending Action

Authorization Bypass in Vikunja Allows Webhook Manipulation

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123506
EUVD
EUVD-2026-119391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja From 2.2.0 (inc) to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Vikunja versions 2.2.0 to 2.7.0. It allows attackers with tokens scoped only to project webhooks to manipulate user-level webhooks by injecting a user_id parameter. This enables unauthorized registration of user webhooks to attacker-controlled endpoints, granting access to reminders and task payloads from all projects owned by the victim.

Detection Guidance

To detect this vulnerability, check Vikunja API logs for requests containing user_id parameters in project webhook endpoints. Look for unauthorized creation, modification, or deletion of user-level webhooks. Review tokens with project_webhooks scope for unusual activity targeting user webhooks.

Impact Analysis

Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects. They can also read, change, or delete existing user webhooks, potentially exposing sensitive project data or disrupting user workflows.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later to patch the authorization bypass. Review and revoke any tokens with project_webhooks scope that may have been misused. Monitor user webhooks for unauthorized changes and restrict API token scopes to the minimum required privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...