Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

Vulnerability

Overview

The GET /api/v1/projects/:project/webhooks endpoint in Vikunja, an open-source task management platform, returns webhook BasicAuth credentials (basic_auth_user and basic_auth_password) in plaintext to any user with read access to the project [1][3]. While the code correctly masks the HMAC secret field, the BasicAuth fields added in a later migration were not given similar treatment, leaving them exposed [3].

Exploitation

Prerequisites

An attacker only needs read-level permissions on a project to exploit this vulnerability. The ReadAll method in pkg/models/webhooks.go requires only project read access, and the BasicAuth fields are included in the JSON response without masking [3]. This allows any collaborator, including those with minimal privileges, to retrieve credentials intended for authenticating against external webhook receivers [1][3].

Impact

A malicious read-only user can steal the BasicAuth credentials configured for project webhooks. These credentials could then be used to authenticate against the external webhook receiver, potentially compromising the integrity of the webhook communication or impersonating the Vikunja instance [1][3].

Mitigation

The issue is fixed in Vikunja version 2.2.1, which was released as part of a larger security update addressing nine vulnerabilities [2]. Users are strongly encouraged to upgrade to the latest version to protect against credential exposure [1][2][3].