EUVD-2026-119391

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projectswebhooks to manage the owner's user-level webhooks by supplying userid in request bodies. Attackers can register user webhooks to their own receiver to obtain...

CVE-2026-123506: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped…

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projectswebhooks to manage the owner's user-level webhooks by supplying userid in request bodies. Attackers can register user webhooks to their own receiver to obtain...