Api: Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

In Vikunja API versions >=0.22.0 and <=2.6.0, when a collaborator is removed from a project, the system's revocation cleanup routine deletes task assignees and subscriptions but does not delete webhooks or link shares created by that collaborator. These two data types provide live channels into the project, allowing the removed collaborator to continue receiving automatic updates of project contents, including new tasks created after their removal. The cleanup routine is triggered only on certain revocation paths (notably team removal) and is not invoked when a user is removed directly from a project. The vulnerability was demonstrated with a proof of concept showing that while direct read access is denied (HTTP 403), webhooks still deliver task information post-removal. The affected versions span all releases from v0.22.0 through v2.6.0 and the current main branch.

A former collaborator retains live, automatic access to project task titles and descriptions via webhooks and link shares even after their access has been revoked. This includes content created after revocation, potentially exposing sensitive project information continuously. However, these webhook and link share artifacts remain visible and auditable to project owners and administrators, who can identify and remove them. The vulnerability requires the attacker to have had write access before removal, so it does not introduce new access to historical data but extends unauthorized access to new content created post-revocation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should manually audit and remove webhooks and link shares created by collaborators who have been removed from projects to prevent continued data leakage. Monitoring project webhook and link share configurations for entries created by former collaborators is recommended. No automatic cleanup currently covers these data types upon collaborator removal, so manual intervention is necessary.