The vulnerability allows any authenticated user with read access to a project to retrieve the BasicAuth user and password fields for that project's webhooks via the GET /api/v1/projects/:project/webhooks endpoint. This unwarranted disclosure can give an attacker credentials to authenticate against external webhook receivers, enabling them to send or receive data on behalf of the project without authorization. The exposed information directly undermines the confidentiality of the external webhook integration.

This issue occurs in the Vikunja task‑management platform, specifically in releases prior to 2.2.1. Users running Vikunja 2.2.0 or older are affected; the vulnerability does not exist in version 2.2.1 or later where the fix is applied.

The CVSS score of 6.5 indicates a moderate to high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by simply sending a request to the listed API endpoint after authenticating with any account that has read permission to the project. No additional credentials or privileges are required beyond project‑read access, making the exploit path straightforward for legitimate collaborators.