Read the docs
TI-2026-26057 Aliases CVE-2026-33677GHSA-7c2g-p23p-4jg3

Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

Priority MEDIUM 62CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoint returns webhook BasicAuth credentials (`basic_auth_user` and `basic_auth_password`) in plaintext to any user with read access to the project. While the existing code correctly masks the HMAC `secret` field, the BasicAuth fields added in a later migration were not given the same treatment. This allows read-only collaborators to steal credentials intended for authenticating against external webhook receivers. Version 2.2.1 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00302 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vikunja (go-vikunja): 2.2.1code.vikunja.io/api (Go): 2.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-vikunjavikunjabefore 2.2.12.2.1Patch availableCNA
—code.vikunja.io/api (Go)before 2.2.12.2.1Patch availableGHSA-7c2g-p23p-4jg3
  • vikunja Vendorgo-vikunja Affected before 2.2.1 Fixed in 2.2.1 Patch available CNA
  • code.vikunja.io/api (Go) Vendor— Affected before 2.2.1 Fixed in 2.2.1 Patch available GHSA-7c2g-p23p-4jg3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*before 2.2.1Vulnerablego-vikunja
  • cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions before 2.2.1 Vulnerable ·go-vikunja

Remediation

  • Fix · CNA vikunja (go-vikunja) Fixed in 2.2.1
  • Fix · GHSA-7c2g-p23p-4jg3 code.vikunja.io/api (Go) Fixed in 2.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33677
  2. 2026-10-03 Alias added: GHSA-7c2g-p23p-4jg3

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
  • TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
  • TI-2026-26060 Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation CVSS 3.1HIGH 7.5
  • TI-2026-20965 Vikunja Affected by XSS Via Task Preview CVSS 4.0HIGH 8.6
  • TI-2026-27698 Vikunja Affected by Privilege Escalation via Project Reparenting CVSS 3.1HIGH 8.3
  • TI-2026-25727 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement CVSS 3.1HIGH 8.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences