What is GHSA-276j-w3vx-r5jh?

GHSA-276j-w3vx-r5jh is a security advisory published by GitHub Security Advisories with High severity. Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows...

Which CVE IDs does GHSA-276j-w3vx-r5jh cover?

GHSA-276j-w3vx-r5jh covers the following CVE IDs: CVE-2026-111919. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-276j-w3vx-r5jh?

GHSA-276j-w3vx-r5jh has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-276j-w3vx-r5jhHighCVSS 6.5

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows...

Vendor

GitHub Security Advisories

Published

October 17, 2026

Last Modified

October 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-111919 →

📋 Description

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm
https://nvd.nist.gov/vuln/detail/CVE-2026-111919
https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks
https://github.com/advisories/GHSA-276j-w3vx-r5jh