Read the docs
TI-2026-26060 Aliases CVE-2026-33680GHSA-8hp8-9fhr-pfm9

Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

Priority HIGH 72CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vikunja (go-vikunja): 2.2.2code.vikunja.io/api (Go): 2.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-vikunjavikunjabefore 2.2.22.2.2Patch availableCNA
—code.vikunja.io/api (Go)before 2.2.22.2.2Patch availableGHSA-8hp8-9fhr-pfm9
  • vikunja Vendorgo-vikunja Affected before 2.2.2 Fixed in 2.2.2 Patch available CNA
  • code.vikunja.io/api (Go) Vendor— Affected before 2.2.2 Fixed in 2.2.2 Patch available GHSA-8hp8-9fhr-pfm9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*before 2.2.2Vulnerablego-vikunja
  • cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions before 2.2.2 Vulnerable ·go-vikunja

Remediation

  • Fix · CNA vikunja (go-vikunja) Fixed in 2.2.2
  • Fix · GHSA-8hp8-9fhr-pfm9 code.vikunja.io/api (Go) Fixed in 2.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33680
  2. 2026-10-03 Alias added: GHSA-8hp8-9fhr-pfm9

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
  • TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
  • TI-2026-20965 Vikunja Affected by XSS Via Task Preview CVSS 4.0HIGH 8.6
  • TI-2026-27698 Vikunja Affected by Privilege Escalation via Project Reparenting CVSS 3.1HIGH 8.3
  • TI-2026-25727 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement CVSS 3.1HIGH 8.1
  • TI-2026-25726 Vikunja has a 2FA Bypass via Caldav Basic Auth CVSS 4.0MEDIUM 6.9
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences