Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) >= 0.22.0, <= 2.6.0; Vikunja v0.22.0 through v2.6.0.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vikunja webhooks and link shares survive access revocation

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Manually audit and delete webhooks and link shares created by removed collaborators using the project settings interface (GET /projects/{p}/webhooks and GET /projects/{p}/shares show creator information). Additionally, review access revocation paths and ensure the cleanup routine is triggered across all four revocation scenarios. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.5 · Published 2026-10-09

Vikunja is a project management and task-tracking platform. When a collaborator is removed from a project, their webhooks and shared links remain active and continue delivering project data they should no longer access, including content created after their removal.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) >= 0.22.0, <= 2.6.0; Vikunja v0.22.0 through v2.6.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Manually audit and delete webhooks and link shares created by removed collaborators using the project settings interface (GET /projects/{p}/webhooks and GET /projects/{p}/shares show creator information). Additionally, review access revocation paths and ensure the cleanup routine is triggered across all four revocation scenarios. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Manually audit and delete webhooks and link shares created by removed collaborators using the project settings interface (GET /projects/{p}/webhooks and GET /projects/{p}/shares show creator information). Additionally, review access revocation paths and ensure the cleanup routine is triggered across all four revocation scenarios.

Technical details

When users lose read access to a project through any of four revocation paths (team member removal, direct project user removal, team project deletion, or user role downgrade), the cleanup routine fails to delete webhooks or link shares created by that user. Only task assignees and subscriptions are deleted. An attacker who previously had write access can maintain a live feed of project tasks and descriptions via webhook delivery or redeemable link shares, including data created post-revocation, despite being denied direct HTTP read access.

Affected products

Vikunja Vikunja v0.22.0 through v2.6.0

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.