CVEvulnerability

CVE-2026-111919

7.1 HIGH Published 2026-10-17 Modified 2026-10-19 Official page ↗

Status: Deferred
Published: 2026-10-17
Last modified: 2026-10-19
Assigner: [email protected]
CVSS 4.0 ([email protected]): 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-613

Description

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

Weakness · not in database (1)

CWE-613

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm github.com
https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks www.vulncheck.com
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm github.com

CVE-2026-111919

Description

Related

Weakness · not in database (1)

References