GHSA-39P5-2WRR-XH29
Vulnerability from github – Published: 2026-10-09 20:52 – Updated: 2026-10-09 20:52Summary
When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a throwaway project, attach team IDs one by one, and read back the name, description, and complete member list of every team on the instance. Normally you can only see teams you belong to; this path ignores that.
Details
Sharing a project with a team is a two-step flow: you PUT a team to the project, then you GET the project's teams to see them. The share endpoint only enforces that you're an admin of the target project, it doesn't care whether the team you're referencing is one you're allowed to see. Any existing team ID is accepted.
The listing endpoint is even more permissive: read access to the project is enough, which you obviously have on a project you created. And its response isn't just a list of team names, it includes each team's description, creator, and a full members array with every member's username, display name, and admin flag.
Put together, an attacker who owns a single project can walk the team ID space and pull the roster of every team in the instance, including teams they aren't a member of. This contradicts how team visibility works everywhere else in the product, where you only ever see teams you belong to. Emails are stripped from the roster, so what leaks is identities and org structure rather than contact details.
The fix is to require that the caller actually has access to the team they're attaching, not just to the project.
PoC
The attacker needs nothing but an ordinary account.
- Create a throwaway project you own:
- Attach team IDs one by one (sweep the range you want):
PUT /api/v1/projects/<your_project_id>/teams
{<SNIP>, "team_id": <N>, <SNIP>}
- Read them back with their rosters:
GET /api/v1/projects/<your_project_id>/teams
Each entry contains the team name, description, creator, and a members array with every member's username, display name, and admin flag, for teams you are not a member of.
Impact
Information disclosure of the instance-wide team directory: team names, descriptions, and full membership, for teams the attacker has no relationship with. This maps out the organisation's group structure and who belongs where, useful for targeting and social engineering. Any authenticated account is enough; no share link, no admin rights, no victim interaction.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.0"
},
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-91980"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-09T20:52:27Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nWhen you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you\u0027re an admin of the project. Listing a project\u0027s teams then returns each team\u0027s full member roster. So any logged-in user can spin up a throwaway project, attach team IDs one by one, and read back the name, description, and complete member list of every team on the instance. Normally you can only see teams you belong to; this path ignores that.\n\n### Details\nSharing a project with a team is a two-step flow: you PUT a team to the project, then you GET the project\u0027s teams to see them. The share endpoint only enforces that you\u0027re an admin of the target project, it doesn\u0027t care whether the team you\u0027re referencing is one you\u0027re allowed to see. Any existing team ID is accepted.\n\nThe listing endpoint is even more permissive: read access to the project is enough, which you obviously have on a project you created. And its response isn\u0027t just a list of team names, it includes each team\u0027s description, creator, and a full members array with every member\u0027s username, display name, and admin flag.\n\nPut together, an attacker who owns a single project can walk the team ID space and pull the roster of every team in the instance, including teams they aren\u0027t a member of. This contradicts how team visibility works everywhere else in the product, where you only ever see teams you belong to. Emails are stripped from the roster, so what leaks is identities and org structure rather than contact details.\n\nThe fix is to require that the caller actually has access to the team they\u0027re attaching, not just to the project.\n\n### PoC\nThe attacker needs nothing but an ordinary account.\n\n1. Create a throwaway project you own:\n2. Attach team IDs one by one (sweep the range you want):\n```\nPUT /api/v1/projects/\u003cyour_project_id\u003e/teams\n{\u003cSNIP\u003e, \"team_id\": \u003cN\u003e, \u003cSNIP\u003e}\n```\n3. Read them back with their rosters:\n```\nGET /api/v1/projects/\u003cyour_project_id\u003e/teams\n```\nEach entry contains the team name, description, creator, and a members array with every member\u0027s username, display name, and admin flag, for teams you are not a member of.\n\n### Impact\nInformation disclosure of the instance-wide team directory: team names, descriptions, and full membership, for teams the attacker has no relationship with. This maps out the organisation\u0027s group structure and who belongs where, useful for targeting and social engineering. Any authenticated account is enough; no share link, no admin rights, no victim interaction.",
"id": "GHSA-39p5-2wrr-xh29",
"modified": "2026-10-09T20:52:27Z",
"published": "2026-10-09T20:52:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-39p5-2wrr-xh29"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91980"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/pull/3688"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vikunja/vikunja"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-team-enumeration-via-project-share"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.