Description
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | 0.22.0 – < 2.7.1 | 2.7.1 |
References
- GitHub Security Advisory (GHSA-586f-48mj-3rwr) vendor-advisory
- VulnCheck Advisory: Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members third-party-advisory