HIGH 7.1 NVD
CVE-2026-123517
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the te
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3r6-33v3-79c2
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-information-disclosure-via-team-
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.