Mass assignment in Vikunja team external_id field allows managed-team tagging
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-915.
Summary
Vikunja before 2.7.1 contains a mass assignment flaw (CWE-915) that lets any authenticated user set the read-only external_id field through the team create and update endpoints. An attacker with PR:L privileges over a remote network can tag a team they create or administer as externally managed, which blocks removal of its members and causes SSO members to be dropped from the team at their next login.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-vikunja | vikunja | before 2.7.1 | 2.7.1 | Patch available | CNA |
- vikunja Vendorgo-vikunja Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* | — | — | go-vikunja |
- cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja
Remediation
Update go-vikunja vikunja to version 2.7.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA vikunja (go-vikunja) Fixed in 2.7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
go-vikunja vikunja 2.7.1
39 records Highest priority Priority MEDIUM 20 MEDIUM, 19 LOW
Other records, highest priority first
- TI-2026-86673 Pagination limit bypass in Vikunja lets users exhaust resourcesPriority MEDIUM 53
- TI-2026-86654 Vikunja exposes password-reset tokens in access logsPriority MEDIUM 52
- TI-2026-86670 Insufficient session expiration in Vikunja token middlewarePriority MEDIUM 48
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123526
- 2026-11-08 Alias added: GHSA-cg54-92gp-5457
References
More go-vikunja vulnerabilities
- TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
- TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
- TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
- TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
- TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
- TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-123526 · CVE Program
- CVE-2026-123526 · NVD
- GHSA-cg54-92gp-5457 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences