GHSA-HJX8-QV73-F7CM: GHSA-HJX8-QV73-F7CM: Incomplete Access Revocation Leading to Webhook Data Exfiltration in Vikunja
GHSA-HJX8-QV73-F7CM: Incomplete Access Revocation Leading to Webhook Data Exfiltration in Vikunja Vulnerability ID: GHSA-HJX8-QV73-F7CM CVSS Score: 6.5 Published: 2026-10-09 An access revocation flaw in Vikunja allows removed collaborators to retain outbound webhooks and link shares created prior to revocation, enabling persistent exfiltration of sensitive task data. When a collaborator is removed from a Vikunja project, active webhooks and link shares created by that user are not removed. The f
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.