Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows a removed collaborator to keep receiving project data through webhooks they created. The attacker can continue to receive task titles and descriptions, including content added after their access was revoked, leaking confidential information.

Vikunja, versions 0.22.0 up to but not including 2.7.0. The vulnerability is present in the Go‑Vikunja implementation of Vikunja and affects all installations running these versions.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so publicly documented exploits are not known. The attack can be performed by any former collaborator who had previously created a webhook; no additional authentication or privileged access is required beyond the original collaborator rights. The risk is moderate to high for organizations that rely on webhook data feeds.