Is CVE-2026-123520 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123520 being exploited in the wild.

How severe is CVE-2026-123520?

High severity, with a CVSS score of 7.1, published 8 November 2026.

How is CVE-2026-123520 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123520?

Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123520: Vikunja privilege escalation via account deletion

CVE-2026-123520 · Severity: high · CVSS 7.1 · Published 2026-11-08

Vikunja is a self-hosted project management and task organization tool. A privilege escalation vulnerability allows team owners to gain administrative control of projects shared with their team at read-only permissions, and potentially lock out the legitimate project owner. An attacker can trigger this by creating a bot account, adding it to their team, and deleting it—or the vulnerability can occur accidentally when any collaborator deletes their account.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123520 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123520 being exploited in the wild.
How severe is CVE-2026-123520?: High severity, with a CVSS score of 7.1, published 8 November 2026.
Which products and versions are affected?: Vikunja 0.18.0 through 2.7.0.
Is there a fix for CVE-2026-123520?: Yes: fixed in 2.7.1. Until then: Scope the account deletion logic to only consider projects owned by the deleted account; delete the user's own share rows during account deletion. As hardening, disable self-service bot deletion or restrict it to instance administrators. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123520 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123520?: Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.1

Scope the account deletion logic to only consider projects owned by the deleted account; delete the user's own share rows during account deletion. As hardening, disable self-service bot deletion or restrict it to instance administrators.

Technical details

The vulnerability stems from improper privilege management in the account deletion logic. When an account is deleted, the system attempts to ensure remaining projects have an admin user by promoting the first available share to admin status. However, it fails to verify project ownership and promotes shares from projects the deleted account only had read-only access to, including team shares. Additionally, if no write shares exist, the promotion also transfers ownership to the promoted user. An authenticated attacker with the ability to create bot accounts can exploit this to escalate privileges on read-only shared projects.

Affected products

Vikunja Vikunja 0.18.0 through 2.7.0

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.