Is CVE-2026-111919 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111919?

CVE-2026-111919 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111919

Description

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.