[ Vendor · 26 CVEs ]
go-vikunja
CVEs affecting go-vikunja published in the last 30 days, plus any go-vikunja CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115507 | 22 Oct 2026 | CVSS 3.5 | go-vikunja vikunjaVikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates… | |
| CVE-2026-111917 | 17 Oct 2026 | CVSS 6.5 | go-vikunja vikunjaVikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation… | |
| CVE-2026-111918 | 17 Oct 2026 | CVSS 5.4 | go-vikunja vikunjaVikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with… | |
| CVE-2026-111919 | 17 Oct 2026 | CVSS 6.5 | go-vikunja vikunjaVikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data… | |
| CVE-2026-111920 | 17 Oct 2026 | CVSS 4.3 | go-vikunja vikunjaVikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective… | |
| CVE-2026-111921 | 17 Oct 2026 | CVSS 5.4 | go-vikunja vikunjaVikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier… | |
| CVE-2026-111922 | 17 Oct 2026 | CVSS 6.3 | go-vikunja vikunjaVikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when… | |
| CVE-2026-57458 | 9 Oct 2026 | CVSS 8.1 | Vikunja: Scoped API token can mint unrestricted OAuth session credentialsVikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can… | Fix |
| CVE-2026-62367 | 9 Oct 2026 | CVSS 7.5 | Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverVikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider… | Fix |
| CVE-2026-62376 | 9 Oct 2026 | CVSS 8.1 | Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessVikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and… | Fix |
| CVE-2026-91985 | 15 Sep 2026 | CVSS 7.5 | Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission levelVikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to… | Fix |
| CVE-2026-91984 | 15 Sep 2026 | CVSS 4.3 | Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated… | Fix |
| CVE-2026-91982 | 15 Sep 2026 | CVSS 4.3 | Vikunja: TOTP secret is readable after enrollment, no step-up authVikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and… | Fix |
| CVE-2026-91983 | 15 Sep 2026 | CVSS 4.3 | Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string… | Fix |
| CVE-2026-91981 | 15 Sep 2026 | CVSS 4.3 | Vikunja: Link-share token can enumerate users through the v2 APIVikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link… | Fix |
| CVE-2026-91979 | 15 Sep 2026 | CVSS 6.5 | Vikunja: Denial of service via decompression bomb in the data importVikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can… | Fix |
| CVE-2026-91980 | 15 Sep 2026 | CVSS 4.3 | Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway projectvikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members… | Fix |
| CVE-2026-91973 | 15 Sep 2026 | CVSS 7.5 | Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwordsVikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote… | Fix |
| CVE-2026-91971 | 15 Sep 2026 | CVSS 6.5 | Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplificationVikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload… | Fix |
| CVE-2026-91972 | 15 Sep 2026 | CVSS 7.5 | Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limitedVikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and… | Fix |
| CVE-2026-91970 | 15 Sep 2026 | CVSS 6.5 | Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the APIVikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets… | Fix |
| CVE-2026-91968 | 15 Sep 2026 | CVSS 6.5 | Vikunja: Unbounded nested task-filter recursion permits API process terminationvikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions… | Fix |
| CVE-2026-91969 | 15 Sep 2026 | CVSS 6.5 | Vikunja: Unbounded CSV row cardinality permits API process terminationvikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit… | Fix |
| CVE-2026-76216 | 19 Aug 2026 | CVSS 7.5 | Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosureVikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with… | |
| CVE-2026-68582 | 2 Aug 2026 | CVSS 6.5 | Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET… | Fix |
| CVE-2026-68581 | 2 Aug 2026 | CVSS 8.1 | Vikunja: Link-share principal ID collision allows cross-account API token issuance and managementVikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are… | Fix |