---
id: CVE-2026-123499
title: >-
  Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml
  Server
summary: >-
  Vikunja veans before 2.7.1 contains a credential exposure vulnerability that
  allows malicious repository authors to capture API tokens by specifying an
  attacker-controlled server in .veans.yml. When veans runs in an untrusted
  checkout, i…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-346
vendor: go-vikunja
product: vikunja
affected:
  - vikunja < 2.7.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:16.315Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123499'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3rrq-h284-5vpx
    label: GitHub Security Advisory (GHSA-3rrq-h284-5vpx)
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-credential-leak-via-repo-controlled-veans-yml-server
    label: >-
      VulnCheck Advisory: Vikunja veans before 2.7.1 Credential Leak via
      Repo-Controlled .veans.yml Server
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.705Z'
---

## Overview

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.

## Affected

- `vikunja < 2.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.