Vikunja before 2.7.1 exposes a flaw that lets authenticated users discover whether private teams exist or are managed by SSO, and whether they are single‑member teams. By issuing DELETE requests to /teams/{id}/members/{own username}, an attacker can interpret the differing HTTP responses to learn sensitive information about the organization’s internal structure.

The vulnerability affects user‑driven installations of the Vikunja application, specifically versions prior to 2.7.1. Any instance of Vikunja running before this release is susceptible to the information leakage through its team self‑removal API endpoint.

The CVSS score of 7.1 indicates a high severity for uncontrolled information disclosure. Because the attack requires authentication, only users with legitimate accounts can exploit it. No particular exploit is known and the EPSS value is unavailable, but the lack of KEV status does not lower the risk; organizations must assume the possibility of a future exploit. The most likely attack vector is an authorized user making crafted DELETE calls to probe team existence and attributes.