HIGH 7.1 NVD
CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhoo
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm
- https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocatio
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-17 via NVD.
vulnfeed aggregates 16186 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.