Read the docs

go-vikunja

Records67All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high29CVSS 7.0–8.9

Exploited now

go-vikunja records in CISA KEV

No go-vikunja vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Vikunja 35 records HIGH

Records

67 records

TI-2026-40929 CVE-2026-56765 · GHSA-pg6g-jf8c-49p7

Authorization bypass in go-vikunja Vikunja

Priority HIGH 81

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00512 Published 2026-07-10 Fixed in 2.2.1 CWE-639
TI-2026-62115 CVE-2026-91985 · GHSA-37rx-7pj5-p885 · GHSA-qfwc-vx6f-3g6g

Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Priority HIGH 77

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2026-09-15 Fixed in 2.6.0 CWE-200
TI-2026-62108 CVE-2026-91973 · GHSA-m469-88xx-8rx2 · GHSA-p2vv-wrh8-x466

Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Priority HIGH 77

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00672 Published 2026-09-15 Fixed in 2.6.0 CWE-307
TI-2026-62107 CVE-2026-91972 · GHSA-6rvj-qwjf-3m4q · GHSA-m4vj-wr5q-cmvr

Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

Priority HIGH 77

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00633 Published 2026-09-15 Fixed in 2.6.0 CWE-307
TI-2026-48322 CVE-2026-68582 · GHSA-p4r4-8cxw-pjx7 · GHSA-rj9j-8772-4h6c

Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Priority HIGH 73

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0033 Published 2026-08-02 Fixed in 2.4.0 CWE-639
TI-2026-20965 CVE-2026-25935 · GHSA-m4g2-2q66-vc9v

Vikunja Affected by XSS Via Task Preview

Priority HIGH 72

Vikunja is a todo-app to organize your life.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00259 Published 2026-02-11 Fixed in 1.1.0 CWE-80
TI-2026-25726 CVE-2026-33315 · GHSA-47cr-f226-r4pq

Vikunja has a 2FA Bypass via Caldav Basic Auth

Priority HIGH 70

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00314 Published 2026-03-24 Fixed in 2.2.0 CWE-288
TI-2026-76128 CVE-2026-111922 · GHSA-r87c-f263-6pfc

Permissive CORS policy trusting localhost origins in Vikunja

Priority HIGH 67

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set.

CVSS 4.0HIGH 7.2 Local No auth User interaction EPSS 0.0015 Published 2026-10-17 Fixed in 2.7.0 CWE-942
TI-2026-22171 CVE-2026-27819 · GHSA-42wg-38gx-85rh

Vikunja has Path Traversal in CLI Restore

Priority HIGH 67

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00832 Published 2026-02-25 Fixed in 2.0.0 CWE-22
TI-2026-76125 CVE-2026-111919 · GHSA-276j-w3vx-r5jh

Improper access revocation in Vikunja webhooks exposes project data

Priority MEDIUM 64

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00355 Published 2026-10-17 Fixed in 2.7.0 CWE-613
TI-2026-76123 CVE-2026-111917 · GHSA-355w-rx9g-pww7

Vikunja WebSocket Authentication Ignores Session Revocation

Priority MEDIUM 64

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions tabl…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00355 Published 2026-10-17 Fixed in 2.7.0 CWE-613
TI-2026-62106 CVE-2026-91971 · GHSA-4vh2-39rq-rq8j · GHSA-69rj-q3v9-vffp

Vikunja before 2.6.0 Denial of Service via Avatar Upload

Priority MEDIUM 64

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-09-15 Fixed in 2.6.0 CWE-400
Load more
Open these records in search →