Threats tagged 'ghsa-cwvj-xw34-46qv'

Vikunja versions prior to 2.7.1 have an information disclosure vulnerability that allows authenticated users to infer the existence and certain attributes of private teams by sending DELETE requests to a specific team member removal endpoint. This flaw enables attackers to distinguish whether a team exists, if it is managed by SSO, or if it has only one member based on the server's responses.