# CVE-2026-111919: Vikunja improper access revocation in webhooks

Source: https://junglewise.ai/threats/cve-2026-111919-vikunja-0-22-0-before-2-7-0-contains-an-improper-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111919 · Severity: medium · CVSS 6.5 · Published 2026-10-17

Vikunja is a project management and task tracking platform. When a collaborator is removed from a project, their previously-created webhooks continue to deliver project data including task titles and descriptions—even content created after removal. A former collaborator with physical access to their webhook receiver maintains an ongoing feed of all project activity indefinitely.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-111919 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111919 being exploited in the wild.

**How severe is CVE-2026-111919?** Medium severity, with a CVSS score of 6.5, published 17 October 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) SEMVER:introduced=0.22.0; Vikunja 0.22.0 through 2.6.0.

**Is there a fix for CVE-2026-111919?** Yes: fixed in 2.7.0. Until then: Audit project webhooks and link shares in project settings after offboarding collaborators; delete any created by departing users to prevent further data leakage. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111919 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111919?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.0

Audit project webhooks and link shares in project settings after offboarding collaborators; delete any created by departing users to prevent further data leakage.

## Technical details

The vulnerability is improper access revocation (CWE-613): Vikunja's cleanup routine deletes task assignees and subscriptions when a user loses project access, but does not delete webhooks or link shares they created. An authenticated user with prior write access creates a webhook to an attacker-controlled endpoint; after removal, the webhook continues to fire on all project updates, delivering titles and descriptions of tasks created post-revocation. The cleanup path is triggered only on team member removal, not on direct project user removal.

## Affected products

- Vikunja Vikunja 0.22.0 through 2.6.0

## Identifiers

- CVE-2026-111919
- GHSA-hjx8-qv73-f7cm
- GO-2026-6733

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm)
- [https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks](https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)