CVE-2026-91980: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you’re an admin of the project. Listing a project’s teams then returns each team’s full member roster. So any logged-in user can spin up a throwaway project, attach team IDs one by one, and read back the name, description, and complete member list of every team on the instance. Normally you can only see teams you belong to; this path ignores that.
References
- github.com/advisories/GHSA-39p5-2wrr-xh29
- github.com/go-vikunja/vikunja/pull/3688
- github.com/go-vikunja/vikunja/releases/tag/v2.6.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-39p5-2wrr-xh29
- nvd.nist.gov/vuln/detail/CVE-2026-91980
- www.vulncheck.com/advisories/vikunja-before-2.6.0-team-enumeration-via-project-share
Code Behaviors & Features
Detect and mitigate CVE-2026-91980 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →