CVE-2026-123520 Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion

What is CVE-2026-123520?

CVE-2026-123520 is a high-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.

Official description

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering ensureProjectAdminUser to promote read-only shares and lock out the real owner.

Weakness: CWE-269

Which versions are affected by CVE-2026-123520?

How do I fix CVE-2026-123520?

No fix has been published for CVE-2026-123520 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123520 being exploited?

There is no known exploitation of CVE-2026-123520 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-4qv2-8cxq-cg82, GHSA-hq66-9qg8-jwqg.