CVE-2026-123504 Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in targeturl values to post to receiving channel...

CVE-2026-123504

Vikunja versions 0.22.0 before 2.7.1 are vulnerable to an information disclosure vulnerability. This flaw allows project members with read-only privileges to view complete webhook target URLs by listing project webhooks. Attackers can exploit this to extract incoming-webhook tokens or API keys em...

EUVD-2026-119389

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in targeturl values to post to receiving channel...

PT-2026-139785

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target url values to post to receiving channe...

CVE-2026-123504: go-vikunja vikunja: Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members…

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in targeturl values to post to receiving channel...