CVE-2026-123506

The software Vikunja (versions 2.2.0 before 2.7.1) contains an authorization bypass vulnerability involving project webhook endpoints. The root cause allows users with tokens scoped only to projects_webhooks to manage an owner's user-level webhooks by supplying a user_id in request bodies. This e...