Executive brief
Vikunja is a project management and task organization application. The vulnerability allows any authenticated user to enumerate all teams in the system and view complete membership rosters, including usernames and admin status, for teams they do not belong to. An attacker can create a disposable project and systematically attach arbitrary team IDs to retrieve sensitive organizational structure information.
Technical details
This is an information disclosure vulnerability (CWE-200) caused by insufficient access control in the project team-sharing endpoint. When attaching a team to a project via PUT /api/v1/projects/{project_id}/teams, the API validates only that the caller is an admin of the target project, but fails to verify that the caller has any access to the team being attached. The subsequent GET /api/v1/projects/{project_id}/teams endpoint then returns the full team roster (usernames, display names, admin flags, and descriptions) for any team listed, regardless of the caller's authorization. An authenticated attacker with any account can exploit this by creating a single project they own, iterating through team IDs, and harvesting the complete instance-wide team directory. The vulnerability is patched in version 2.6.0.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed: GHSA-39p5-2wrr-xh29 published
- 2026-09-15: patched: Version 2.6.0 released with fix
- 2026-09-15: advisory: CVE-2026-91980 published