CVE-2026-111919

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111919
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111919.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111919
Aliases
Published
2026-10-17T18:46:33Z
Modified
2026-10-20T10:30:33Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
Details

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-613"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111919.json"
}
References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type
GIT
Repo
https://github.com/go-vikunja/vikunja
Events
Introduced
f08fc8eeb4c82a85efbf480cebcd4146c6529e6a
Fixed
a16be96aa454671fdf213b0fbe411dd38a098418
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.22.0"
        },
        {
            "fixed":  "2.7.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.22.0
v0.22.1
v0.23.0
v0.24.1
v1.*
v1.0.0
v1.0.0-rc0
v1.0.0-rc1
v1.0.0-rc2
v1.0.0-rc3
v1.0.0-rc4
v1.1.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v2.5.0
v2.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111919.json"