CVE-2026-123517
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.