CVE-2026-111919 go-vikunja CVE debrief

Who should care

Defenders who manage Vikunja instances, especially those with multiple users and projects, should be aware of this vulnerability and take steps to verify and remediate it. This includes verifying the version of Vikunja being used, revising webhook configurations, and monitoring project data and user access.

Why it matters

CVE-2026-111919 is a high-severity vulnerability in Vikunja that allows removed collaborators to continue receiving project data through webhooks. Defenders should prioritize verifying and remediating this vulnerability in their Vikunja instances.

• Defenders need to verify if their Vikunja instances are vulnerable and remediate as necessary
• Removed collaborators may still receive sensitive project data through webhooks
• Defenders should monitor project data and user access to detect potential exploitation
• Patching or upgrading to a fixed version of Vikunja is necessary to resolve the issue

Technical summary

The vulnerability is caused by an improper access revocation mechanism in Vikunja, which allows removed collaborators to continue receiving project data through webhooks they created. This issue affects Vikunja versions 0.22.0 before 2.7.0. The vulnerability allows removed collaborators to keep receiving task titles and descriptions through their webhook, including content created after their access was revoked. Defenders should prioritize verifying and remediating this vulnerability in their Vikunja instances, especially if they have users who have been removed from projects.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Vikunja instances, especially if they have users who have been removed from projects.

Recommended defensive actions

• Verify the version of Vikunja being used and assess if it is vulnerable
• Revise webhook configurations to ensure that removed collaborators are properly revoked
• Monitor project data and user access to detect potential exploitation
• Apply the patch or upgrade to a fixed version of Vikunja as soon as possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the issue and its impact. The vulnerability allows removed collaborators to keep receiving task titles and descriptions through their webhook, including content created after their access was revoked. There is no evidence of public exploitation, but defenders should verify the version of Vikunja being used, revise webhook configurations, and monitor project data and to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.