PT-2026-139787

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects webhooks to manage the owner's user-level webhooks by supplying user id in request bodies. Attackers can register user webhooks to their own receiver to obtain...