---
id: CVE-2026-111919
title: Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
summary: >-
  Vikunja 0.22.0 before 2.7.0 contains an improper access revocation
  vulnerability that allows removed collaborators to keep receiving project data
  through webhooks they created. Former collaborators keep receiving task titles
  and descript…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: go-vikunja
product: vikunja
affected:
  - vikunja >= 0.22.0 < 2.7.0
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:33.951Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111919'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm
    label: GitHub Security Advisory (GHSA-hjx8-qv73-f7cm)
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks
    label: >-
      VulnCheck Advisory: Vikunja 0.22.0 before 2.7.0 Improper Access Revocation
      via Webhooks
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.644Z'
---

## Overview

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

## Affected

- `vikunja >= 0.22.0 < 2.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.