{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.2.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T21:17:28Z",
    "nvd_published_at": "2026-03-24T16:16:35Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `GET /api/v1/projects/:project/webhooks` endpoint returns webhook BasicAuth credentials (`basic_auth_user` and `basic_auth_password`) in plaintext to any user with read access to the project. While the existing code correctly masks the HMAC `secret` field, the BasicAuth fields added in a later migration were not given the same treatment. This allows read-only collaborators to steal credentials intended for authenticating against external webhook receivers.\n\n## Details\n\nWhen listing project webhooks, the `ReadAll` method in `pkg/models/webhooks.go` (line 203) only requires project read access:\n\n```go\n// pkg/models/webhooks.go:203-244\nfunc (w *Webhook) ReadAll(s *xorm.Session, a web.Auth, _ string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error) {\n\tp := \u0026Project{ID: w.ProjectID}\n\tcan, _, err := p.CanRead(s, a)  // Only requires read permission\n\tif err != nil {\n\t\treturn nil, 0, 0, err\n\t}\n\tif !can {\n\t\treturn nil, 0, 0, ErrGenericForbidden{}\n\t}\n\n\t// ... fetches webhooks from DB ...\n\n\tfor _, webhook := range ws {\n\t\twebhook.Secret = \"\"  // HMAC secret is masked\n\t\t// BasicAuthUser and BasicAuthPassword are NOT masked\n\t\tif createdBy, has := users[webhook.CreatedByID]; has {\n\t\t\twebhook.CreatedBy = createdBy\n\t\t}\n\t}\n\n\treturn ws, len(ws), total, err\n}\n```\n\nThe `Webhook` struct defines both fields with JSON serialization tags, so they are included in API responses:\n\n```go\n// pkg/models/webhooks.go:63-64\nBasicAuthUser     string `xorm:\"null\" json:\"basic_auth_user\"`\nBasicAuthPassword string `xorm:\"null\" json:\"basic_auth_password\"`\n```\n\nThe BasicAuth fields were added in migration `20260123000717` (\"Add basic auth to webhooks\"), but the credential masking logic at line 238 was not updated to include these new fields.\n\nThe same issue exists in the user webhook listing at `pkg/routes/api/v1/user_webhooks.go:65`, where `Secret` is masked but BasicAuth fields are not. This is lower impact since users only see their own webhooks.\n\n## PoC\n\n1. **As User A (project admin)**, create a project and a webhook with BasicAuth credentials:\n\n```bash\n# Create a webhook with BasicAuth on project 1\ncurl -X PUT \"http://localhost:3456/api/v1/projects/1/webhooks\" \\\n  -H \"Authorization: Bearer $TOKEN_A\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"target_url\": \"https://external-service.example.com/hook\",\n    \"events\": [\"task.created\"],\n    \"secret\": \"my-hmac-secret\",\n    \"basic_auth_user\": \"service-account\",\n    \"basic_auth_password\": \"S3cretP@ssw0rd!\"\n  }\u0027\n```\n\n2. **As User B (read-only collaborator on the same project)**, list webhooks:\n\n```bash\ncurl -s \"http://localhost:3456/api/v1/projects/1/webhooks\" \\\n  -H \"Authorization: Bearer $TOKEN_B\" | jq \u0027.[0] | {secret, basic_auth_user, basic_auth_password}\u0027\n```\n\n3. **Expected output** (secret is masked, but BasicAuth is leaked):\n\n```json\n{\n  \"secret\": \"\",\n  \"basic_auth_user\": \"service-account\",\n  \"basic_auth_password\": \"S3cretP@ssw0rd!\"\n}\n```\n\n## Impact\n\n- **Credential theft**: Any user with read-only access to a project can steal BasicAuth credentials configured on that project\u0027s webhooks. These credentials may grant access to external services (CI/CD systems, notification endpoints, third-party APIs).\n- **Lateral movement**: Stolen credentials could be reused to authenticate against external systems that the webhook receiver protects.\n- **Broad exposure surface**: Credentials are exposed to all project readers, including users granted access through team shares and link shares (with read+ permission level).\n\n## Recommended Fix\n\nIn `pkg/models/webhooks.go`, add masking for BasicAuth fields alongside the existing `Secret` masking (around line 237):\n\n```go\nfor _, webhook := range ws {\n\twebhook.Secret = \"\"\n\twebhook.BasicAuthUser = \"\"\n\twebhook.BasicAuthPassword = \"\"\n\tif createdBy, has := users[webhook.CreatedByID]; has {\n\t\twebhook.CreatedBy = createdBy\n\t}\n}\n```\n\nApply the same fix in `pkg/routes/api/v1/user_webhooks.go` (around line 64):\n\n```go\nfor _, w := range ws {\n\tw.Secret = \"\"\n\tw.BasicAuthUser = \"\"\n\tw.BasicAuthPassword = \"\"\n\tif createdBy, has := users[w.CreatedByID]; has {\n\t\tw.CreatedBy = createdBy\n\t}\n}\n```",
  "id": "GHSA-7c2g-p23p-4jg3",
  "modified": "2026-03-25T21:17:28Z",
  "published": "2026-03-25T21:17:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7c2g-p23p-4jg3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33677"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    },
    {
      "type": "WEB",
      "url": "https://vikunja.io/changelog/vikunja-v2.2.2-was-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API"
}