CVE-2026-91980
Medium
Description
vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams.
SeverityMedium
CVSS4.3
Exploit probability—
ProductCode.vikunja.io/api
PublishedSep 15, 2026
First seenSep 15, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- code.vikunja.io/api2.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| code.vikunja.io/apiGo | v < 2.6.0, No range specified | 2.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.