# code.vikunja.io/api (Go) vulnerabilities 63 known vulnerabilities (4 critical, 23 high, 36 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.24.6 (Dec 22, 2024): affected by 63 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 31 since v0.13.1 (May 19, 2020) - Registry: https://pkg.go.dev/code.vikunja.io/api - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-111922: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-111921: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-111920: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-111919: v0.22.0 to v0.24.6 (through the newest release) - CVE-2026-111918: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-111917: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-62376: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-62367: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-57458: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91985: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91984: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91983: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91982: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91981: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91980: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91979: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91973: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91972: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91971: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91970: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91969: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-91968: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-55067: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-55066: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-55065: v0.24.6 (through the newest release) - CVE-2026-55064: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-54766: v0.21.0 to v0.24.6 (through the newest release) - CVE-2026-76216: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-68582: v0.24.0 to v0.24.6 (through the newest release) - CVE-2026-68581: v0.22.0 to v0.24.6 (through the newest release) - CVE-2026-56765: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-40103: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35602: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35601: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35600: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35599: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35598: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35597: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35596: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35595: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-35594: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-34727: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33700: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33680: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33679: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33678: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33677: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33676: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33675: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33668: v0.18.0 to v0.24.6 (through the newest release) - CVE-2026-33474: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33473: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33316: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33315: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33313: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-33312: v0.20.2 to v0.24.6 (through the newest release) - CVE-2026-29794: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-28268: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-27819: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-27616: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-27575: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-27116: v0.13.1 to v0.24.6 (through the newest release) - CVE-2026-25935: v0.13.1 to v0.24.6 (through the newest release) ## Advisories (63) ### [CVE-2026-111922](https://cve.now/CVE-2026-111922): Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins - Severity: High 7.2 - Published: Oct 17, 2026 - Affected: from 2.2.0, through 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-111921](https://cve.now/CVE-2026-111921): Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion - Severity: Medium 5.3 - Published: Oct 17, 2026 - Affected: from 0.13.0, fixed in 2.7.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-111920](https://cve.now/CVE-2026-111920): Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions - Severity: Medium 5.3 - Published: Oct 17, 2026 - Affected: versions 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-111919](https://cve.now/CVE-2026-111919): Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks - Severity: High 7.1 - Published: Oct 17, 2026 - Affected: from 0.22.0, through 2.6.0; from 0.22.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-111918](https://cve.now/CVE-2026-111918): Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation - Severity: Medium 5.3 - Published: Oct 17, 2026 - Affected: from 1.0.0-rc0, fixed in 2.7.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-111917](https://cve.now/CVE-2026-111917): Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation - Severity: High 7.1 - Published: Oct 17, 2026 - Affected: from 2.3.0, through 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-62376](https://cve.now/CVE-2026-62376): Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access - Severity: High 8.1 - Published: Oct 9, 2026 - Affected: fixed in 2.4.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-62367](https://cve.now/CVE-2026-62367): Vikunja: OIDC email-fallback account linking ignores email\_verified, enabling local-account takeover - Severity: High 7.5 - Published: Oct 9, 2026 - Affected: from 1.0.0, fixed in 2.4.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-57458](https://cve.now/CVE-2026-57458): Vikunja: Scoped API token can mint unrestricted OAuth session credentials - Severity: High 8.1 - Published: Oct 9, 2026 - Affected: from 2.3.0, fixed in 2.4.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91985](https://cve.now/CVE-2026-91985): Vikunja before 2.6.0 Privilege Escalation via Link Share Hash - Severity: High 8.7 - Published: Sep 15, 2026 - Affected: all versions; fixed in 2.6.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91984](https://cve.now/CVE-2026-91984): Vikunja before 2.6.0 Broken Object-Level Authorization via task-position - Severity: Medium 5.3 - Published: Sep 15, 2026 - Affected: all versions; fixed in 2.6.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91983](https://cve.now/CVE-2026-91983): Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter - Severity: Medium 5.3 - Published: Sep 15, 2026 - Affected: from 1.0.0, fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91982](https://cve.now/CVE-2026-91982): Vikunja before 2.6.0 TOTP Secret Disclosure via API - Severity: Medium 4.3 - Published: Sep 15, 2026 - Affected: all versions; fixed in 2.6.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91981](https://cve.now/CVE-2026-91981): Vikunja before 2.6.0 User Enumeration via v2 API - Severity: Medium 4.3 - Published: Sep 15, 2026 - Affected: all versions; fixed in 2.6.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91980](https://cve.now/CVE-2026-91980): vikunja before 2.6.0 Team Enumeration via Project Share - Severity: Medium 4.3 - Published: Sep 15, 2026 - Affected: fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91979](https://cve.now/CVE-2026-91979): Vikunja before 2.6.0 Denial of Service via Decompression Bomb - Severity: Medium 6.5 - Published: Sep 15, 2026 - Affected: fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91973](https://cve.now/CVE-2026-91973): Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth - Severity: High 8.7 - Published: Sep 15, 2026 - Affected: fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91972](https://cve.now/CVE-2026-91972): Vikunja before 2.6.0 Authentication Bypass via Unthrottled API - Severity: High 8.7 - Published: Sep 15, 2026 - Affected: all versions; fixed in 2.6.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91971](https://cve.now/CVE-2026-91971): Vikunja before 2.6.0 Denial of Service via Avatar Upload - Severity: High 7.1 - Published: Sep 15, 2026 - Affected: fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91970](https://cve.now/CVE-2026-91970): Vikunja before 2.6.0 Resource Exhaustion via Planka Migration - Severity: Medium 6.5 - Published: Sep 15, 2026 - Affected: from 2.5.0, fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91969](https://cve.now/CVE-2026-91969): vikunja before 2.6.0 Resource Exhaustion via CSV Migration - Severity: Medium 6.5 - Published: Sep 15, 2026 - Affected: from 2.5.0, fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-91968](https://cve.now/CVE-2026-91968): vikunja before 2.6.0 Denial of Service via unbounded filter recursion - Severity: Medium 6.5 - Published: Sep 15, 2026 - Affected: from 2.5.0, fixed in 2.6.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-55067](https://cve.now/CVE-2026-55067): Vikunja: Authenticated cross-tenant kanban-bucket relocation via \`project\_view\_id\` mass-assignment - Severity: Medium 5.0 - Published: Aug 28, 2026 - Affected: all versions; fixed in 2.4.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-55066](https://cve.now/CVE-2026-55066): Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task\_id - Severity: High 7.1 - Published: Aug 28, 2026 - Affected: fixed in 2.4.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-55065](https://cve.now/CVE-2026-55065): Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api - Severity: High 8.1 - Published: Aug 28, 2026 - Affected: from 0.24.6; from 0.24.6, fixed in 2.4.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-55064](https://cve.now/CVE-2026-55064): Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent\_project\_id=0 - Severity: Medium 4.3 - Published: Aug 28, 2026 - Affected: from 2.3.0, fixed in 2.4.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-54766](https://cve.now/CVE-2026-54766): Vikunja: Project duplication bypasses write-permission check on the target parent project - Severity: Medium 5.3 - Published: Aug 28, 2026 - Affected: from 0.21.0; from 0.21.0, fixed in 2.4.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-76216](https://cve.now/CVE-2026-76216): Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing - Severity: High 7.7 - Published: Aug 19, 2026 - Affected: fixed in 2.5.0. - No fix released. The advisory names 2.5.0 as the fix, which the registry doesn't have yet. The latest release, v0.24.6, is still affected. ### [CVE-2026-68582](https://cve.now/CVE-2026-68582): Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token - Severity: Critical 9.3 - Published: Aug 2, 2026 - Affected: from 0.24.0; from 0.24.0, fixed in 2.4.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-68581](https://cve.now/CVE-2026-68581): Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision - Severity: High 8.6 - Published: Aug 2, 2026 - Affected: from 0.22.0; from 0.22.0, fixed in 2.4.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-56765](https://cve.now/CVE-2026-56765): Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR - Severity: Critical 9.3 - Published: Jul 10, 2026 - Affected: all versions; fixed in 2.2.1. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-40103](https://cve.now/CVE-2026-40103): Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds - Severity: Medium 4.3 - Published: Apr 10, 2026 - Affected: fixed in 2.3.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35602](https://cve.now/CVE-2026-35602): Vikunja has a File Size Limit Bypass via Vikunja Import - Severity: Medium 5.4 - Published: Apr 10, 2026 - Affected: fixed in 2.3.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35601](https://cve.now/CVE-2026-35601): Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output - Severity: Medium 4.1 - Published: Apr 10, 2026 - Affected: all versions; fixed in 2.3.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35600](https://cve.now/CVE-2026-35600): Vikunja has HTML Injection via Task Titles in Overdue Email Notifications - Severity: Medium 5.4 - Published: Apr 10, 2026 - Affected: all versions; fixed in 2.3.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35599](https://cve.now/CVE-2026-35599): Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler - Severity: Medium 6.5 - Published: Apr 10, 2026 - Affected: all versions; fixed in 2.3.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35598](https://cve.now/CVE-2026-35598): Vikunja has Missing Authorization on CalDAV Task Read - Severity: Medium 4.3 - Published: Apr 10, 2026 - Affected: fixed in 2.3.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35597](https://cve.now/CVE-2026-35597): Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout - Severity: Medium 5.9 - Published: Apr 10, 2026 - Affected: fixed in 2.3.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35596](https://cve.now/CVE-2026-35596): Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug - Severity: Medium 4.3 - Published: Apr 10, 2026 - Affected: fixed in 2.3.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35595](https://cve.now/CVE-2026-35595): Vikunja Affected by Privilege Escalation via Project Reparenting - Severity: High 8.3 - Published: Apr 10, 2026 - Affected: all versions; fixed in 2.3.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-35594](https://cve.now/CVE-2026-35594): Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade - Severity: Medium 6.5 - Published: Apr 10, 2026 - Affected: fixed in 2.3.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-34727](https://cve.now/CVE-2026-34727): Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path - Severity: High 7.4 - Published: Apr 10, 2026 - Affected: all versions; fixed in 2.3.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33700](https://cve.now/CVE-2026-33700): Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion - Severity: Medium 6.9 - Published: Mar 24, 2026 - Affected: all versions; fixed in 2.2.1. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33680](https://cve.now/CVE-2026-33680): Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation - Severity: High 7.5 - Published: Mar 24, 2026 - Affected: fixed in 2.2.2; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33679](https://cve.now/CVE-2026-33679): Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections - Severity: Medium 6.4 - Published: Mar 24, 2026 - Affected: fixed in 2.2.1; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33678](https://cve.now/CVE-2026-33678): Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion - Severity: High 8.1 - Published: Mar 24, 2026 - Affected: fixed in 2.2.1; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33677](https://cve.now/CVE-2026-33677): Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API - Severity: Medium 6.5 - Published: Mar 24, 2026 - Affected: all versions; fixed in 2.2.1. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33676](https://cve.now/CVE-2026-33676): Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read - Severity: Medium 6.5 - Published: Mar 24, 2026 - Affected: all versions; fixed in 2.2.1. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33675](https://cve.now/CVE-2026-33675): Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources - Severity: Medium 6.4 - Published: Mar 24, 2026 - Affected: all versions; fixed in 2.2.1. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33668](https://cve.now/CVE-2026-33668): Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect - Severity: High 7.1 - Published: Mar 24, 2026 - Affected: from 0.18.0; from 0.18.0, fixed in 2.2.1. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33474](https://cve.now/CVE-2026-33474): Vikunja Affected by DoS via Image Preview Generation - Severity: Medium 6.5 - Published: Mar 24, 2026 - Affected: all versions; from 1.0.0-rc0, fixed in 2.2.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33473](https://cve.now/CVE-2026-33473): Vikunja has TOTP Reuse During Validity Window - Severity: Medium 5.7 - Published: Mar 24, 2026 - Affected: from 0.13; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33316](https://cve.now/CVE-2026-33316): Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement - Severity: High 8.1 - Published: Mar 24, 2026 - Affected: through 2.1.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33315](https://cve.now/CVE-2026-33315): Vikunja has a 2FA Bypass via Caldav Basic Auth - Severity: Medium 6.9 - Published: Mar 24, 2026 - Affected: all versions; through 2.1.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33313](https://cve.now/CVE-2026-33313): Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments - Severity: Medium 5.3 - Published: Mar 24, 2026 - Affected: through 2.1.0; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-33312](https://cve.now/CVE-2026-33312): Read-only Vikunja users can delete project background images via broken object-level authorization - Severity: Medium 5.3 - Published: Mar 20, 2026 - Affected: from 0.20.2; from 0.20.2, fixed in 2.2.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-29794](https://cve.now/CVE-2026-29794): Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers - Severity: Medium 5.3 - Published: Mar 20, 2026 - Affected: all versions; from 0.8, fixed in 2.2.0. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-28268](https://cve.now/CVE-2026-28268): Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse - Severity: Critical 9.8 - Published: Feb 27, 2026 - Affected: all versions; through 0.24.6. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-27819](https://cve.now/CVE-2026-27819): Vikunja has Path Traversal in CLI Restore - Severity: High 7.2 - Published: Feb 25, 2026 - Affected: all versions; through 0.24.6. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-27616](https://cve.now/CVE-2026-27616): Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure - Severity: High 7.3 - Published: Feb 25, 2026 - Affected: through 0.24.6; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-27575](https://cve.now/CVE-2026-27575): Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change - Severity: Critical 9.1 - Published: Feb 25, 2026 - Affected: through 0.24.6; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-27116](https://cve.now/CVE-2026-27116): Vikunja has Reflected HTML Injection via filter Parameter in Projects Module - Severity: Medium 6.1 - Published: Feb 25, 2026 - Affected: through 0.24.6; all versions. - No fix released. The latest release, v0.24.6, is still affected. ### [CVE-2026-25935](https://cve.now/CVE-2026-25935): Vikunja Affected by XSS Via Task Preview - Severity: High 8.6 - Published: Feb 11, 2026 - Affected: through 0.24.6; all versions. - No fix released. The latest release, v0.24.6, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/code.vikunja.io/api Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.