CVE-2026-123522

CVE-2026-123522CVE-2026-123522

Description

Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications.

Scoring

CVSS 7.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Last modified2026-11-08
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.