Threats tagged 'ghsa-2qh8-f3vq-4qjq'

Vikunja versions from 0.22.0 up to but not including 2.7.1 have an information disclosure vulnerability. This flaw allows read-only project members to view full webhook target URLs by listing project webhooks. Sensitive tokens or API keys embedded in these URLs can be extracted and potentially reused by attackers until they are rotated.