CVE-2026-111919

Vikunja versions 0.22.0 before 2.7.0 are vulnerable to an improper access revocation flaw regarding webhooks. The root cause allows removed collaborators to continue receiving project data, specifically task titles and descriptions , via webhooks they created prior to their removal. This includes...