Vikunja versions 0.22.0 through 2.7.1 allow a user with read‑only project membership to list all project webhooks. The listed target_url of each webhook may contain incoming‑webhook tokens or API keys. Because these credentials are embedded in the URL, an attacker can reuse them to post arbitrary payloads to the target services until the key is rotated, compromising confidentiality and enabling unauthorized actions on external endpoints.

The open‑source Vikunja project management platform is affected in all releases from 0.22.0 up to but not including 2.7.1. Any deployment that has not applied the vendor patch that brought the software to version 2.7.1 is vulnerable.

The CVSS score of 5.3 indicates medium severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA's KEV catalog. The attack requires a user with at least read‑only membership in a project, so it is not an unauthenticated remote exploit. Once a read‑only member gains visibility into webhook URLs, they can extract embedded tokens or API keys and use them to perform further malicious actions against the webhook target services.