Vikunja versions before 2.7.1 contain a mass‑assignment flaw that lets any authenticated user alter the read‑only external_id field through team create and update APIs. By marking a team as externally managed, the attacker permanently blocks removal of members and forces SSO users to be discarded on their next login, resulting in a denial of service on team membership and disrupting collaboration.

The vulnerable product is Vikunja, hosted under the vendor go‑vikunja:vikunja. All releases prior to 2.7.1 are affected; the flaw is exposed through the team API endpoints used by authenticated users.

The CVSS score of 5.3 classifies the vulnerability as medium severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting no widely known exploitation campaigns. Attackers require legitimate authentication and API access, so the attack vector is internal or through compromised credentials. Once authenticated, an attacker can set the read‑only external_id field, preventing future member removal and breaking SSO integration.