CVE-2026-123504
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.