Vulnerability Description
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3r6-33v3-79c2
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-information-disclosure
FAQ
What is CVE-2026-123517?
CVE-2026-123517 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attacke...
How severe is CVE-2026-123517?
CVE-2026-123517 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-123517?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.