# CVE-2026-123504: Vikunja information disclosure in webhook URLs

Source: https://junglewise.ai/threats/cve-2026-123504-vikunja-from-0-22-0-before-2-7-1-contains-an-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123504 · Severity: medium · CVSS 4.3 · Published 2026-11-08

Vikunja is a project management and task organization platform. Read-only project members can view complete webhook target URLs, which often contain embedded API keys or authentication tokens. An attacker with read-only access can extract these credentials and use them to post messages to external services or reuse the keys until they are rotated.

Technologies: [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-123504 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123504 being exploited in the wild.

**How severe is CVE-2026-123504?** Medium severity, with a CVSS score of 4.3, published 8 November 2026.

**Which products and versions are affected?** Vikunja 0.22.0 to 2.7.0.

**Is there a fix for CVE-2026-123504?** Yes: fixed in 2.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123504 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123504?** Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.1

## Technical details

The vulnerability is an authorization bypass (CWE-863) and information disclosure (CWE-200) in the webhook listing functionality. The ReadAll and CanRead methods in the webhook permissions layer check only for Project.CanRead instead of Project.CanWrite, allowing read-only members to retrieve full target URLs. While maskCredentials() strips basic-auth and secret fields, it does not redact the TargetURL itself, which commonly embeds API tokens and webhook credentials.

## Affected products

- Vikunja Vikunja 0.22.0 to 2.7.0

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-586f-48mj-3rwr](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-586f-48mj-3rwr)
- [https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.1-webhook-url-credential-exposure-to-read-only-members](https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.1-webhook-url-credential-exposure-to-read-only-members)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)