Go-vikunja vulnerabilities
105 CVEs and advisories name Go-vikunja as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-91969vikunja before 2.6.0 Resource Exhaustion via CSV Migration
- CVE-2026-91968vikunja before 2.6.0 Denial of Service via unbounded filter recursion
- CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
- CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
- CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api
- CVE-2026-55064Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
- CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent project
- CVE-2026-76216Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
- CVE-2026-68582Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
- CVE-2026-68581Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
- CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
- CVE-2026-35602Vikunja has a File Size Limit Bypass via Vikunja Import
- CVE-2026-35601Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output
- CVE-2026-35600Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
- CVE-2026-35599Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler
- CVE-2026-35598Vikunja has Missing Authorization on CalDAV Task Read
- CVE-2026-35597Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
- CVE-2026-35596Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
- CVE-2026-35595Vikunja Affected by Privilege Escalation via Project Reparenting
- CVE-2026-35594Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
- CVE-2026-34727Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
- CVE-2026-33700Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion
- CVE-2026-33680Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
- CVE-2026-33679Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
- CVE-2026-33678Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
- CVE-2026-33677Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API
- CVE-2026-33676Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
- CVE-2026-33675Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
- CVE-2026-33668Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
- CVE-2026-33474Vikunja Affected by DoS via Image Preview Generation