Is CVE-2026-123506 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123506 being exploited in the wild.

How severe is CVE-2026-123506?

Medium severity, with a CVSS score of 5.4, published 8 November 2026.

How is CVE-2026-123506 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123506?

Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123506: Vikunja authorization bypass in webhook API scope

CVE-2026-123506 · Severity: medium · CVSS 5.4 · Published 2026-11-08

Vikunja is a task management and project planning application. A flaw in its API allows holders of tokens intended only for managing project webhooks to bypass authorization and instead access the account owner's user-level webhooks. An attacker could register webhooks to intercept sensitive data like task payloads and reminders from all owner projects, or modify and delete existing webhooks.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123506 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123506 being exploited in the wild.
How severe is CVE-2026-123506?: Medium severity, with a CVSS score of 5.4, published 8 November 2026.
Which products and versions are affected?: Vikunja 2.2.0 before 2.7.1.
Is there a fix for CVE-2026-123506?: Yes: fixed in 2.7.1. Until then: Restrict issuance of projects_webhooks-scoped tokens to trusted integrations only, and monitor webhook creation and modification events for anomalies. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123506 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123506?: Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.1

Restrict issuance of projects_webhooks-scoped tokens to trusted integrations only, and monitor webhook creation and modification events for anomalies.

Technical details

The vulnerability is an incorrect authorization check in the webhook API endpoints (CWE-863 and CWE-915) affecting versions 2.2.0 through 2.7.0. A token scoped to projects_webhooks can manipulate user-level webhooks by supplying a user_id parameter in request bodies; the API fails to strip this parameter or validate that the token scope forbids user-level operations. The attack requires a valid narrowly-scoped token and network access to the API.

Affected products

Vikunja Vikunja 2.2.0 before 2.7.1

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.