Threats tagged 'ghsa-cg54-92gp-5457'

Vikunja versions prior to 2.7.1 have a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field via team creation and update endpoints. This flaw enables attackers to mark a team as externally managed, which permanently blocks removal of all members and causes single sign-on (SSO) members to be dropped from the team upon their next login.