# CVE-2026-123526: Vikunja mass assignment in team external_id field

Source: https://junglewise.ai/threats/cve-2026-123526-vikunja-before-2-7-1-contains-a-mass-assignment-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123526 · Severity: medium · CVSS 5.4 · Published 2026-11-08

Vikunja is a web-based task management and collaboration platform. A vulnerability allows any authenticated user to set a hidden "external_id" field on teams, which prevents team members from being removed and causes single sign-on users to be dropped from the team at next login. An attacker can exploit this on teams they create or manage, permanently locking in members.

Technologies: [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-123526 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123526 being exploited in the wild.

**How severe is CVE-2026-123526?** Medium severity, with a CVSS score of 5.4, published 8 November 2026.

**Which products and versions are affected?** Vikunja before 2.7.1.

**Is there a fix for CVE-2026-123526?** Yes: fixed in 2.7.1. Until then: An instance administrator can delete an affected team via the DELETE /api/v2/teams/{id} endpoint to recover the instance, though this removes all associated project shares. Operators can harden running instances by rejecting requests where the team body carries a non-empty external_id at the reverse proxy level. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123526 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123526?** Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.1

An instance administrator can delete an affected team via the DELETE /api/v2/teams/{id} endpoint to recover the instance, though this removes all associated project shares. Operators can harden running instances by rejecting requests where the team body carries a non-empty external_id at the reverse proxy level.

## Technical details

A mass assignment vulnerability in the Team.Create and Team.Update endpoints fails to strip the read-only external_id field from request bodies, allowing any authenticated principal to set it. Once set, TeamMember.Delete rejects all removal attempts (self-removal, admin removal, and instance admin removal) with an error message about externally managed teams. The vulnerability requires authentication but no special role; a newly registered account is sufficient.

## Affected products

- Vikunja Vikunja before 2.7.1

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g)
- [https://www.vulncheck.com/advisories/vikunja-before-2.7.1-mass-assignment-via-team-external-id-field](https://www.vulncheck.com/advisories/vikunja-before-2.7.1-mass-assignment-via-team-external-id-field)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)