CVE-2026-111919CWE-613

CVE-2026-111919

Medium · published October 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-10-17T23:16Z
References (3)
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm · [email protected]https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks · [email protected]https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
    cvelistv5
  • 17 OCT 18:46Z
    Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
    cvelistv5