Is CVE-2026-111919 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111919 being exploited in the wild.

How severe is CVE-2026-111919?

Medium severity, with a CVSS score of 6.5, published 17 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) SEMVER:introduced=0.22.0; Vikunja 0.22.0 through 2.6.0.

How is CVE-2026-111919 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111919?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111919: Vikunja improper access revocation in webhooks

CVE-2026-111919 · Severity: medium · CVSS 6.5 · Published 2026-10-17

Vikunja is a project management and task tracking platform. When a collaborator is removed from a project, their previously-created webhooks continue to deliver project data including task titles and descriptions—even content created after removal. A former collaborator with physical access to their webhook receiver maintains an ongoing feed of all project activity indefinitely.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-111919 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111919 being exploited in the wild.
How severe is CVE-2026-111919?: Medium severity, with a CVSS score of 6.5, published 17 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) SEMVER:introduced=0.22.0; Vikunja 0.22.0 through 2.6.0.
Is there a fix for CVE-2026-111919?: Yes: fixed in 2.7.0. Until then: Audit project webhooks and link shares in project settings after offboarding collaborators; delete any created by departing users to prevent further data leakage. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111919 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111919?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Audit project webhooks and link shares in project settings after offboarding collaborators; delete any created by departing users to prevent further data leakage.

Technical details

The vulnerability is improper access revocation (CWE-613): Vikunja's cleanup routine deletes task assignees and subscriptions when a user loses project access, but does not delete webhooks or link shares they created. An authenticated user with prior write access creates a webhook to an attacker-controlled endpoint; after removal, the webhook continues to fire on all project updates, delivering titles and descriptions of tasks created post-revocation. The cleanup path is triggered only on team member removal, not on direct project user removal.

Affected products

Vikunja Vikunja 0.22.0 through 2.6.0

Identifiers

CVE-2026-111919
GHSA-hjx8-qv73-f7cm
GO-2026-6733

Timeline

2026-10-03: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.