The vulnerability resides in the project webhook endpoints of Vikunja versions between 2.2.0 and 2.7.0. It enables an actor who holds a token scoped only to project_webhooks to supply a user_id field in request bodies and thereby act as if they were the webhook’s owner. By doing so, the attacker can create, read, modify or delete webhooks that belong to any user, exposing remote execution of tasks such as reminders and payloads intended for the legitimate user.

Affected are all [Vikunja] deployments running any version from 2.2.0 up to and including 2.7.0. Versions 2.7.1 and later contain the fix.

The CVSS score is 5.3, indicating a moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to possess a valid project_webhook scope token, which might be obtained through other compromised credentials or weak token distribution practices. Once the token is in hand, exploitation is straightforward and does not require additional privileges beyond the token scope.