Vikunja, from version 0.23.0 up to but not including 2.7.1, has a flaw that allows users with project write permissions to read confidential task data from private projects. By registering a webhook, the attacker can monitor payloads for task modifications. Because the webhook payload is built using the triggering user’s permissions, it contains related_tasks information—including titles, descriptions, and metadata—from projects that the attacker otherwise cannot view, exposing sensitive information.

The affected product is Vikunja, distributed by go‑vikunja, in all releases from 0.23.0 through the last pre‑2.7.1 build. Users running any of these versions are susceptible; updating to 2.7.1 or later mitigates the vulnerability.

The CVSS score of 6.9 indicates a medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that mass exploitation is currently unlikely. However, attackers need only possess write access to a project and the ability to register a webhook, which is a relatively low barrier within typical collaborative environments. Once a webhook is registered, any subsequent modification of a linked task will reveal private project data in the payload, giving the attacker persistent and continuous visibility into confidential tasks.