CVE-2026-123522
Deferred Deferred - Pending Action

Authorization Bypass in Vikunja via Task Injection

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123522
EUVD
EUVD-2026-119407

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123522 is an authorization bypass vulnerability in Vikunja versions up to 2.7.0. It allows authenticated users to read any task by injecting a crafted task object into a Kanban bucket move operation. Attackers can set task.id to a victim's task and task.project_id to their own project, causing full task contents to be sent to their webhook or forged mention notifications.

Detection Guidance

To detect this vulnerability, monitor Vikunja server logs for unusual Kanban bucket move operations or webhook requests containing task data from unauthorized projects. Check for requests with task.id and task.project_id parameters set to conflicting values. Review webhook endpoints for unexpected task content delivery.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive task data, including titles, descriptions, and metadata, even if they lack proper permissions. Attackers can exfiltrate this information by iterating through task IDs, potentially leading to data breaches or misuse of confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other privacy regulations by enabling unauthorized access to sensitive personal or health data. Organizations may face legal penalties, reputational damage, and loss of trust due to data exposure.

Mitigation Strategies

Immediately upgrade Vikunja to version 2.7.1 or later to patch the vulnerability. If upgrading is not possible, restrict authenticated user access to Kanban board move operations and disable webhook endpoints until patched. Review and audit task access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...