CVE-2026-111919Medium· 6.5▾ SunlitVikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descript…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.
vikunja >= 0.22.0 < 2.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111917Medium· 6.5Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-111918Medium· 5.4Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
CVE-2026-111920Medium· 4.3Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
CVE-2026-111922Medium· 6.3Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
CVE-2026-111921Medium· 5.4Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
CVE-2026-91968Medium· 6.5vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits