# cve.now: Go-vikunja

The newest entries naming Go-vikunja as an affected vendor (up to 200), of 105 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123531](https://cve.now/CVE-2026-123531.md): Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter (CVSS 8.7)
- [CVE-2026-123530](https://cve.now/CVE-2026-123530.md): Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints (CVSS 6.0)
- [CVE-2026-123529](https://cve.now/CVE-2026-123529.md): Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color (CVSS 5.1)
- [CVE-2026-123528](https://cve.now/CVE-2026-123528.md): Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware (CVSS 7.6)
- [CVE-2026-123527](https://cve.now/CVE-2026-123527.md): Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass (CVSS 5.3)
- [CVE-2026-123526](https://cve.now/CVE-2026-123526.md): Vikunja before 2.7.1 Mass Assignment via Team external\_id Field (CVSS 5.3)
- [CVE-2026-123525](https://cve.now/CVE-2026-123525.md): Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations (CVSS 7.1)
- [CVE-2026-123524](https://cve.now/CVE-2026-123524.md): Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related\_tasks Payload (CVSS 6.9)
- [CVE-2026-123523](https://cve.now/CVE-2026-123523.md): Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache (CVSS 7.1)
- [CVE-2026-123522](https://cve.now/CVE-2026-123522.md): Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook (CVSS 7.1)
- [CVE-2026-123521](https://cve.now/CVE-2026-123521.md): Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint (CVSS 6.0)
- [CVE-2026-123520](https://cve.now/CVE-2026-123520.md): Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion (CVSS 7.1)
- [CVE-2026-123519](https://cve.now/CVE-2026-123519.md): Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports (CVSS 7.1)
- [CVE-2026-123518](https://cve.now/CVE-2026-123518.md): Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move (CVSS 5.3)
- [CVE-2026-123517](https://cve.now/CVE-2026-123517.md): Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint (CVSS 7.1)
- [CVE-2026-123516](https://cve.now/CVE-2026-123516.md): Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import (CVSS 7.1)
- [CVE-2026-123515](https://cve.now/CVE-2026-123515.md): Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images (CVSS 5.1)
- [CVE-2026-123514](https://cve.now/CVE-2026-123514.md): Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion (CVSS 5.3)
- [CVE-2026-123513](https://cve.now/CVE-2026-123513.md): Vikunja before 2.7.1 Auth Token Leak via API URL Change (CVSS 7.6)
- [CVE-2026-123512](https://cve.now/CVE-2026-123512.md): Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs (CVSS 8.4)
- [CVE-2026-123511](https://cve.now/CVE-2026-123511.md): Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries (CVSS 5.3)
- [CVE-2026-123510](https://cve.now/CVE-2026-123510.md): Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath (CVSS 1.0)
- [CVE-2026-123509](https://cve.now/CVE-2026-123509.md): Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count (CVSS 5.3)
- [CVE-2026-123508](https://cve.now/CVE-2026-123508.md): Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain (CVSS 2.0)
- [CVE-2026-123507](https://cve.now/CVE-2026-123507.md): Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter (CVSS 5.1)
- [CVE-2026-123506](https://cve.now/CVE-2026-123506.md): Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints (CVSS 5.3)
- [CVE-2026-123505](https://cve.now/CVE-2026-123505.md): Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database (CVSS 6.8)
- [CVE-2026-123504](https://cve.now/CVE-2026-123504.md): Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members (CVSS 5.3)
- [CVE-2026-123503](https://cve.now/CVE-2026-123503.md): Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion (CVSS 5.3)
- [CVE-2026-123502](https://cve.now/CVE-2026-123502.md): Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging (CVSS 6.9)
- [CVE-2026-123501](https://cve.now/CVE-2026-123501.md): Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes (CVSS 7.1)
- [CVE-2026-123500](https://cve.now/CVE-2026-123500.md): Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump (CVSS 6.9)
- [CVE-2026-123499](https://cve.now/CVE-2026-123499.md): Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server (CVSS 6.0)
- [CVE-2026-123498](https://cve.now/CVE-2026-123498.md): Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata (CVSS 2.1)
- [CVE-2026-123497](https://cve.now/CVE-2026-123497.md): Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery (CVSS 7.6)
- [CVE-2026-123496](https://cve.now/CVE-2026-123496.md): Vikunja veans before 2.7.1 Symlink Following in veans init (CVSS 4.8)
- [CVE-2026-123495](https://cve.now/CVE-2026-123495.md): Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback (CVSS 5.1)
- [CVE-2026-123494](https://cve.now/CVE-2026-123494.md): Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks (CVSS 5.1)
- [CVE-2026-123493](https://cve.now/CVE-2026-123493.md): Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens (CVSS 5.3)
- [CVE-2026-115507](https://cve.now/CVE-2026-115507.md): Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header (CVSS 5.1)
- [CVE-2026-111922](https://cve.now/CVE-2026-111922.md): Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins (CVSS 7.2)
- [CVE-2026-111921](https://cve.now/CVE-2026-111921.md): Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion (CVSS 5.3)
- [CVE-2026-111920](https://cve.now/CVE-2026-111920.md): Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions (CVSS 5.3)
- [CVE-2026-111919](https://cve.now/CVE-2026-111919.md): Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks (CVSS 7.1)
- [CVE-2026-111918](https://cve.now/CVE-2026-111918.md): Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation (CVSS 5.3)
- [CVE-2026-111917](https://cve.now/CVE-2026-111917.md): Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation (CVSS 7.1)
- [CVE-2026-62376](https://cve.now/CVE-2026-62376.md): Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access (CVSS 8.1)
- [CVE-2026-62367](https://cve.now/CVE-2026-62367.md): Vikunja: OIDC email-fallback account linking ignores email\_verified, enabling local-account takeover (CVSS 7.5)
- [CVE-2026-57458](https://cve.now/CVE-2026-57458.md): Vikunja: Scoped API token can mint unrestricted OAuth session credentials (CVSS 8.1)
- [CVE-2026-91985](https://cve.now/CVE-2026-91985.md): Vikunja before 2.6.0 Privilege Escalation via Link Share Hash (CVSS 8.7)
- [CVE-2026-91984](https://cve.now/CVE-2026-91984.md): Vikunja before 2.6.0 Broken Object-Level Authorization via task-position (CVSS 5.3)
- [CVE-2026-91983](https://cve.now/CVE-2026-91983.md): Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter (CVSS 5.3)
- [CVE-2026-91982](https://cve.now/CVE-2026-91982.md): Vikunja before 2.6.0 TOTP Secret Disclosure via API (CVSS 4.3)
- [CVE-2026-91981](https://cve.now/CVE-2026-91981.md): Vikunja before 2.6.0 User Enumeration via v2 API (CVSS 4.3)
- [CVE-2026-91980](https://cve.now/CVE-2026-91980.md): vikunja before 2.6.0 Team Enumeration via Project Share (CVSS 4.3)
- [CVE-2026-91979](https://cve.now/CVE-2026-91979.md): Vikunja before 2.6.0 Denial of Service via Decompression Bomb (CVSS 6.5)
- [CVE-2026-91973](https://cve.now/CVE-2026-91973.md): Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth (CVSS 8.7)
- [CVE-2026-91972](https://cve.now/CVE-2026-91972.md): Vikunja before 2.6.0 Authentication Bypass via Unthrottled API (CVSS 8.7)
- [CVE-2026-91971](https://cve.now/CVE-2026-91971.md): Vikunja before 2.6.0 Denial of Service via Avatar Upload (CVSS 7.1)
- [CVE-2026-91970](https://cve.now/CVE-2026-91970.md): Vikunja before 2.6.0 Resource Exhaustion via Planka Migration (CVSS 6.5)
- [CVE-2026-91969](https://cve.now/CVE-2026-91969.md): vikunja before 2.6.0 Resource Exhaustion via CSV Migration (CVSS 6.5)
- [CVE-2026-91968](https://cve.now/CVE-2026-91968.md): vikunja before 2.6.0 Denial of Service via unbounded filter recursion (CVSS 6.5)
- [CVE-2026-55067](https://cve.now/CVE-2026-55067.md): Vikunja: Authenticated cross-tenant kanban-bucket relocation via \`project\_view\_id\` mass-assignment (CVSS 5.0)
- [CVE-2026-55066](https://cve.now/CVE-2026-55066.md): Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task\_id (CVSS 7.1)
- [CVE-2026-55065](https://cve.now/CVE-2026-55065.md): Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api (CVSS 8.1)
- [CVE-2026-55064](https://cve.now/CVE-2026-55064.md): Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent\_project\_id=0 (CVSS 4.3)
- [CVE-2026-54766](https://cve.now/CVE-2026-54766.md): Vikunja: Project duplication bypasses write-permission check on the target parent project (CVSS 5.3)
- [CVE-2026-76216](https://cve.now/CVE-2026-76216.md): Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing (CVSS 7.7)
- [CVE-2026-68582](https://cve.now/CVE-2026-68582.md): Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token (CVSS 9.3)
- [CVE-2026-68581](https://cve.now/CVE-2026-68581.md): Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision (CVSS 8.6)
- [CVE-2026-40103](https://cve.now/CVE-2026-40103.md): Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds (CVSS 4.3)
- [CVE-2026-35602](https://cve.now/CVE-2026-35602.md): Vikunja has a File Size Limit Bypass via Vikunja Import (CVSS 5.4)
- [CVE-2026-35601](https://cve.now/CVE-2026-35601.md): Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output (CVSS 4.1)
- [CVE-2026-35600](https://cve.now/CVE-2026-35600.md): Vikunja has HTML Injection via Task Titles in Overdue Email Notifications (CVSS 5.4)
- [CVE-2026-35599](https://cve.now/CVE-2026-35599.md): Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler (CVSS 6.5)
- [CVE-2026-35598](https://cve.now/CVE-2026-35598.md): Vikunja has Missing Authorization on CalDAV Task Read (CVSS 4.3)
- [CVE-2026-35597](https://cve.now/CVE-2026-35597.md): Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout (CVSS 5.9)
- [CVE-2026-35596](https://cve.now/CVE-2026-35596.md): Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug (CVSS 4.3)
- [CVE-2026-35595](https://cve.now/CVE-2026-35595.md): Vikunja Affected by Privilege Escalation via Project Reparenting (CVSS 8.3)
- [CVE-2026-35594](https://cve.now/CVE-2026-35594.md): Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade (CVSS 6.5)
- [CVE-2026-34727](https://cve.now/CVE-2026-34727.md): Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path (CVSS 7.4)
- [CVE-2026-33700](https://cve.now/CVE-2026-33700.md): Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion (CVSS 6.9)
- [CVE-2026-33680](https://cve.now/CVE-2026-33680.md): Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation (CVSS 7.5)
- [CVE-2026-33679](https://cve.now/CVE-2026-33679.md): Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections (CVSS 6.4)
- [CVE-2026-33678](https://cve.now/CVE-2026-33678.md): Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion (CVSS 8.1)
- [CVE-2026-33677](https://cve.now/CVE-2026-33677.md): Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API (CVSS 6.5)
- [CVE-2026-33676](https://cve.now/CVE-2026-33676.md): Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read (CVSS 6.5)
- [CVE-2026-33675](https://cve.now/CVE-2026-33675.md): Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources (CVSS 6.4)
- [CVE-2026-33668](https://cve.now/CVE-2026-33668.md): Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect (CVSS 7.1)
- [CVE-2026-33474](https://cve.now/CVE-2026-33474.md): Vikunja Affected by DoS via Image Preview Generation (CVSS 6.5)
- [CVE-2026-33473](https://cve.now/CVE-2026-33473.md): Vikunja has TOTP Reuse During Validity Window (CVSS 5.7)
- [CVE-2026-33336](https://cve.now/CVE-2026-33336.md): Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation (CVSS 6.5)
- [CVE-2026-33335](https://cve.now/CVE-2026-33335.md): Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal (CVSS 6.4)
- [CVE-2026-33334](https://cve.now/CVE-2026-33334.md): Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration (CVSS 6.5)
- [CVE-2026-33316](https://cve.now/CVE-2026-33316.md): Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement (CVSS 8.1)
- [CVE-2026-33315](https://cve.now/CVE-2026-33315.md): Vikunja has a 2FA Bypass via Caldav Basic Auth (CVSS 6.9)
- [CVE-2026-33313](https://cve.now/CVE-2026-33313.md): Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments (CVSS 5.3)
- [CVE-2026-33312](https://cve.now/CVE-2026-33312.md): Read-only Vikunja users can delete project background images via broken object-level authorization (CVSS 5.3)
- [CVE-2026-29794](https://cve.now/CVE-2026-29794.md): Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers (CVSS 5.3)
- [CVE-2026-28268](https://cve.now/CVE-2026-28268.md): Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse (CVSS 9.8)
- [CVE-2026-27819](https://cve.now/CVE-2026-27819.md): Vikunja has Path Traversal in CLI Restore (CVSS 7.2)
- [CVE-2026-27616](https://cve.now/CVE-2026-27616.md): Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure (CVSS 7.3)
- [CVE-2026-27575](https://cve.now/CVE-2026-27575.md): Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change (CVSS 9.1)
- [CVE-2026-27116](https://cve.now/CVE-2026-27116.md): Vikunja has Reflected HTML Injection via filter Parameter in Projects Module (CVSS 6.1)
- [CVE-2026-25935](https://cve.now/CVE-2026-25935.md): Vikunja Affected by XSS Via Task Preview (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/go-vikunja
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.