CVE-2026-123504

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.

Referanslar

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-586f-48mj-3rwr
• https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.1-webhook-url-credential-exposure-to-read-only-members