CVE-2026-123517 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint

What is CVE-2026-123517?

CVE-2026-123517 is a high-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.

Official description

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.

Weakness: CWE-204

Which versions are affected by CVE-2026-123517?

How do I fix CVE-2026-123517?

No fix has been published for CVE-2026-123517 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123517 being exploited?

There is no known exploitation of CVE-2026-123517 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-cwvj-xw34-46qv, GHSA-v3r6-33v3-79c2.