CVE-2026-123508

Vikunja versions before 2.7.1 are susceptible to a supply chain risk due to the use of mutable latest references when fetching the xgo module and Docker image within the mage release targets. An attacker who successfully compromises the upstream xgo module, the image itself, or the registry can i...