CVE-2026-123526
Deferred Deferred - Pending Action

Vikunja Mass Assignment Flaw Enables Team Lockout

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123526
EUVD
EUVD-2026-119411

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a mass assignment vulnerability in Vikunja versions before 2.7.1. It allows any authenticated user to set the read-only external_id field via team creation or update endpoints. Attackers can mark a team as externally managed, preventing member removal and causing SSO users to be dropped at their next login.

Detection Guidance

To detect this vulnerability, check Vikunja versions before 2.7.1 by running: 'vikunja version' or inspecting the application's version file. Review team creation and update API logs for requests containing the 'external_id' field. Look for teams marked as externally managed where member removal fails with 'cannot remove a user from an externally managed team' errors.

Impact Analysis

If exploited, attackers can permanently block removal of team members, including themselves or others. SSO-authenticated users may be automatically removed from the team during their next login. The only recovery is deleting the entire team, which also removes associated project shares.

Mitigation Strategies

Immediately upgrade Vikunja to version 2.7.1 or later if available. As a workaround, delete affected teams to restore member access. Block requests containing 'external_id' at the reverse proxy level. Monitor team management actions and failed member removal attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123526. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...