CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 17 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revok…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.7.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.
Last activity 17 Oct 2026. Patch Forecast updates every hour.