Information Disclosure in Vikunja Prior to 2.7.1

Executive Summary

CVE-2026-123517 is an information disclosure vulnerability in Vikunja versions before 2.7.1. Authenticated users can exploit the team member self-removal endpoint to check if private teams exist by sending DELETE requests to /teams/{id}/members/{own username} with arbitrary team IDs. The responses reveal whether the team exists, is SSO-managed, or has a single member.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for DELETE requests to /teams/{id}/members/{own username} endpoints with arbitrary team IDs. Check for distinguishable responses like 412 for SSO-managed teams, last-member errors, or 200 with no deletion. Use tools like curl to test endpoints: curl -X DELETE -H 'Authorization: Bearer <token>' https://<vikunja-server>/teams/<arbitrary-id>/members/<username>

Inspect server logs for repeated unauthorized access attempts to team endpoints. Enable detailed logging for the Vikunja application to capture response codes and payloads for analysis.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this to gather intelligence about private teams in a Vikunja instance. While no sensitive data like team names or member lists is exposed, the ability to confirm team existence may aid in further attacks, such as targeted phishing or social engineering.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance by exposing information about private team structures, potentially violating data protection principles under GDPR or HIPAA. However, no direct disclosure of personal data occurs, so the impact depends on specific regulatory interpretations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Vikunja to version 2.7.1 or later to patch the vulnerability. If updating is not possible, restrict access to the /teams/{id}/members/{own username} endpoint by implementing stricter authorization checks or network-level controls.

Review and audit all team-related endpoints for similar authorization flaws. Monitor for any signs of exploitation and rotate authentication tokens if unauthorized access is suspected.

Useful 0 Not Useful 0