Skip to main content
cve.nowby Sazabi
← Go
GoPackage

code.vikunja.io/api

63 known vulnerabilities (4 critical, 23 high, 36 medium), with the versions each affects and the releases that fix them.

Latest release
v0.24.6 (Dec 22, 2024): affected by 63 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
63 · 4 critical, 23 high, 36 medium
Releases
31 since v0.13.1 (May 19, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 63 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 63

  • Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

    Affected: from 2.2.0, through 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-111921Medium 5.3

    Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

    Affected: from 0.13.0, fixed in 2.7.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-111920Medium 5.3

    Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions

    Affected: versions 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

    Affected: from 0.22.0, through 2.6.0; from 0.22.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-111918Medium 5.3

    Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

    Affected: from 1.0.0-rc0, fixed in 2.7.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

    Affected: from 2.3.0, through 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

    Affected: fixed in 2.4.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

    Affected: from 1.0.0, fixed in 2.4.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja: Scoped API token can mint unrestricted OAuth session credentials

    Affected: from 2.3.0, fixed in 2.4.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

    Affected: all versions; fixed in 2.6.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91984Medium 5.3

    Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

    Affected: all versions; fixed in 2.6.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91983Medium 5.3

    Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

    Affected: from 1.0.0, fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91982Medium 4.3

    Vikunja before 2.6.0 TOTP Secret Disclosure via API

    Affected: all versions; fixed in 2.6.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91981Medium 4.3

    Vikunja before 2.6.0 User Enumeration via v2 API

    Affected: all versions; fixed in 2.6.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91980Medium 4.3

    vikunja before 2.6.0 Team Enumeration via Project Share

    Affected: fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

Show all 63 advisoriesShow fewer advisories
  • CVE-2026-91979Medium 6.5

    Vikunja before 2.6.0 Denial of Service via Decompression Bomb

    Affected: fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

    Affected: fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

    Affected: all versions; fixed in 2.6.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja before 2.6.0 Denial of Service via Avatar Upload

    Affected: fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91970Medium 6.5

    Vikunja before 2.6.0 Resource Exhaustion via Planka Migration

    Affected: from 2.5.0, fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91969Medium 6.5

    vikunja before 2.6.0 Resource Exhaustion via CSV Migration

    Affected: from 2.5.0, fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-91968Medium 6.5

    vikunja before 2.6.0 Denial of Service via unbounded filter recursion

    Affected: from 2.5.0, fixed in 2.6.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-55067Medium 5.0

    Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

    Affected: all versions; fixed in 2.4.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

    Affected: fixed in 2.4.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

    Affected: from 0.24.6; from 0.24.6, fixed in 2.4.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-55064Medium 4.3

    Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

    Affected: from 2.3.0, fixed in 2.4.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-54766Medium 5.3

    Vikunja: Project duplication bypasses write-permission check on the target parent project

    Affected: from 0.21.0; from 0.21.0, fixed in 2.4.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

    Affected: fixed in 2.5.0.

    No fix released. The advisory names 2.5.0 as the fix, which the registry doesn't have yet. The latest release, v0.24.6, is still affected.

  • CVE-2026-68582Critical 9.3

    Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

    Affected: from 0.24.0; from 0.24.0, fixed in 2.4.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

    Affected: from 0.22.0; from 0.22.0, fixed in 2.4.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-56765Critical 9.3

    Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

    Affected: all versions; fixed in 2.2.1.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-40103Medium 4.3

    Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

    Affected: fixed in 2.3.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35602Medium 5.4

    Vikunja has a File Size Limit Bypass via Vikunja Import

    Affected: fixed in 2.3.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35601Medium 4.1

    Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output

    Affected: all versions; fixed in 2.3.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35600Medium 5.4

    Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

    Affected: all versions; fixed in 2.3.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35599Medium 6.5

    Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

    Affected: all versions; fixed in 2.3.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35598Medium 4.3

    Vikunja has Missing Authorization on CalDAV Task Read

    Affected: fixed in 2.3.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35597Medium 5.9

    Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

    Affected: fixed in 2.3.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35596Medium 4.3

    Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

    Affected: fixed in 2.3.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja Affected by Privilege Escalation via Project Reparenting

    Affected: all versions; fixed in 2.3.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-35594Medium 6.5

    Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

    Affected: fixed in 2.3.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

    Affected: all versions; fixed in 2.3.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33700Medium 6.9

    Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

    Affected: all versions; fixed in 2.2.1.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

    Affected: fixed in 2.2.2; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33679Medium 6.4

    Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections

    Affected: fixed in 2.2.1; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

    Affected: fixed in 2.2.1; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33677Medium 6.5

    Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

    Affected: all versions; fixed in 2.2.1.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33676Medium 6.5

    Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

    Affected: all versions; fixed in 2.2.1.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33675Medium 6.4

    Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

    Affected: all versions; fixed in 2.2.1.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

    Affected: from 0.18.0; from 0.18.0, fixed in 2.2.1.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33474Medium 6.5

    Vikunja Affected by DoS via Image Preview Generation

    Affected: all versions; from 1.0.0-rc0, fixed in 2.2.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33473Medium 5.7

    Vikunja has TOTP Reuse During Validity Window

    Affected: from 0.13; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

    Affected: through 2.1.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33315Medium 6.9

    Vikunja has a 2FA Bypass via Caldav Basic Auth

    Affected: all versions; through 2.1.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33313Medium 5.3

    Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

    Affected: through 2.1.0; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-33312Medium 5.3

    Read-only Vikunja users can delete project background images via broken object-level authorization

    Affected: from 0.20.2; from 0.20.2, fixed in 2.2.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-29794Medium 5.3

    Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

    Affected: all versions; from 0.8, fixed in 2.2.0.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-28268Critical 9.8

    Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

    Affected: all versions; through 0.24.6.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja has Path Traversal in CLI Restore

    Affected: all versions; through 0.24.6.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

    Affected: through 0.24.6; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-27575Critical 9.1

    Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

    Affected: through 0.24.6; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • CVE-2026-27116Medium 6.1

    Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

    Affected: through 0.24.6; all versions.

    No fix released. The latest release, v0.24.6, is still affected.

  • Vikunja Affected by XSS Via Task Preview

    Affected: through 0.24.6; all versions.

    No fix released. The latest release, v0.24.6, is still affected.