CVE-2026-123526: Vikunja mass assignment in team external_id field

CVE-2026-123526 · Severity: medium · CVSS 5.4 · Published 2026-11-08

Vikunja is a web-based task management and collaboration platform. A vulnerability allows any authenticated user to set a hidden "external_id" field on teams, which prevents team members from being removed and causes single sign-on users to be dropped from the team at next login. An attacker can exploit this on teams they create or manage, permanently locking in members.

Technologies: Vikunja. Vendors: Vikunja.

Quick answers

Is CVE-2026-123526 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123526 being exploited in the wild.
How severe is CVE-2026-123526?
Medium severity, with a CVSS score of 5.4, published 8 November 2026.
Which products and versions are affected?
Vikunja before 2.7.1.
Is there a fix for CVE-2026-123526?
Yes: fixed in 2.7.1. Until then: An instance administrator can delete an affected team via the DELETE /api/v2/teams/{id} endpoint to recover the instance, though this removes all associated project shares. Operators can harden running instances by rejecting requests where the team body carries a non-empty external_id at the reverse proxy level. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123526 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-123526?
Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.7.1

An instance administrator can delete an affected team via the DELETE /api/v2/teams/{id} endpoint to recover the instance, though this removes all associated project shares. Operators can harden running instances by rejecting requests where the team body carries a non-empty external_id at the reverse proxy level.

Technical details

A mass assignment vulnerability in the Team.Create and Team.Update endpoints fails to strip the read-only external_id field from request bodies, allowing any authenticated principal to set it. Once set, TeamMember.Delete rejects all removal attempts (self-removal, admin removal, and instance admin removal) with an error message about externally managed teams. The vulnerability requires authentication but no special role; a newly registered account is sufficient.

Affected products

  • Vikunja Vikunja before 2.7.1

Timeline

  • 2026-10-22: disclosed
  • 2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.