Listen to this Post
The vulnerability resides in the revocation handling paths of Vikunja projects, specifically concerning webhooks and link shares created by project collaborators. When a collaborator or team member loses access to a project, Vikunja features a cleanup routine designed to strip away derived residual items such as task assignees and subscriptions. However, this cleanup set omits project webhooks and link shares entirely. Furthermore, this remediation routine is strictly wired to only one out of four potential revocation paths—namely, team member removal—while direct project user deletion or role downgrades fail to invoke any cleanup routines. As a result, an evicted collaborator retains an active, continuous automated feed or link access to project resources, permitting them to intercept real-time task s and descriptions created long after their authorization has been formally terminated.
DailyCVE Form:
Platform: Vikunja
Version: v0.22.0 – v2.6.0
Vulnerability : Access Control
Severity: Medium
date: 2026-04-09
Prediction: 2026-04-09
What Undercode Say
Bash Commands and Codes
Verify affected paths and check for webhook deletion logic in source grep -rn "cleanupTaskMembersAfterTeamRemoval" pkg/models/ git log -S "cleanupTaskMembersAfterTeamRemoval" --oneline
// Excerpt from pkg/models/teams.go showing missing webhook and link share cleanup entities
_, err = s.In("task_id", taskIDs).And("user_id = ?", memberID).
Delete(&TaskAssginee{})
_, err = s.In("entity_id", taskIDs).
Where("entity_type = ? AND user_id = ?", SubscriptionEntityTask, memberID).
Delete(&Subscription{})
// Missing: deletion logic for webhooks and link shares tied to departing users
Exploit: (Educational Purposes!)
- Provision a test user collaborator account with write permissions to a target project inside a vulnerable Vikunja deployment.
- Create an active project webhook or a link share via the collaborator account to hook an external listener endpoint.
- Revoke the collaborator’s access via direct project user removal or team-based offboarding paths.
- Create a new task or modify project contents as the project owner.
- Observe that the webhook continues to fire and transmit payloads containing the newly created task descriptions to the former collaborator’s sink, and verify that link shares remain fully redeemable despite the revocation event.
Protection
Upgrade your Vikunja deployment to version 2.3.0 or later where link shares and webhooks are properly validated or cleaned up upon user removal, or ensure that access controls explicitly re-validate creator permissions on webhook delivery and share redemption routes.
Impact
A former project collaborator can continuously exfiltrate real-time updates, task s, and descriptions of a private project indefinitely after their access rights have been revoked, undermining organizational offboarding boundaries and data confidentiality guarantees.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
