Vulnerabilities

TI-2026-28929 CVE-2026-40103 · GHSA-v479-vf79-mg83

Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

MEDIUM 58

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00226 Published 2026-04-10 Fixed in 2.3.0 CWE-836

TI-2026-27705 CVE-2026-35602 · GHSA-qh78-rvg3-cv54

Vikunja has a File Size Limit Bypass via Vikunja Import

MEDIUM 64

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00351 Published 2026-04-10 Fixed in 2.3.0 CWE-770

TI-2026-27704 CVE-2026-35601 · GHSA-2g7h-7rqr-9p4r

Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output

MEDIUM 52

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 4.1 Network Low privileges User interaction EPSS 0.00203 Published 2026-04-10 Fixed in 2.3.0 CWE-93

TI-2026-27703 CVE-2026-35600 · GHSA-45q4-x4r9-8fqj

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

MEDIUM 58

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00202 Published 2026-04-10 Fixed in 2.3.0 CWE-79

TI-2026-27702 CVE-2026-35599 · GHSA-r4fg-73rc-hhh7

Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00361 Published 2026-04-10 Fixed in 2.3.0 CWE-407

TI-2026-27701 CVE-2026-35598 · GHSA-48ch-p4gq-x46x

Vikunja has Missing Authorization on CalDAV Task Read

MEDIUM 53

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00224 Published 2026-04-10 Fixed in 2.3.0 CWE-862

TI-2026-27700 CVE-2026-35597 · GHSA-fgfv-pv97-6cmj

Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

HIGH 66

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00308 Published 2026-04-10 Fixed in 2.3.0 CWE-307

TI-2026-27699 CVE-2026-35596 · GHSA-hj5c-mhh2-g7jq

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

MEDIUM 53

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-04-10 Fixed in 2.3.0 CWE-863

TI-2026-27698 CVE-2026-35595 · GHSA-2vq4-854f-5c72

Vikunja Affected by Privilege Escalation via Project Reparenting

HIGH 71

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-04-10 Fixed in 2.3.0 CWE-269

TI-2026-27697 CVE-2026-35594 · GHSA-96q5-xm3p-7m84

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

HIGH 68

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00317 Published 2026-04-10 Fixed in 2.3.0 CWE-613

TI-2026-26971 CVE-2026-34727 · GHSA-8jvc-mcx6-r4cg

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

HIGH 74

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00292 Published 2026-04-10 Fixed in 2.3.0 CWE-287

TI-2026-26079 CVE-2026-33700 · GHSA-f95f-77jx-fcjc

Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

LOW 30

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00261 Published 2026-03-24 Fixed in 2.2.1 CWE-639

TI-2026-26060 CVE-2026-33680 · GHSA-8hp8-9fhr-pfm9

Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

HIGH 72

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00405 Published 2026-03-24 Fixed in 2.2.2 CWE-285

TI-2026-26059 CVE-2026-33679 · GHSA-g9xj-752q-xh63

Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections

HIGH 66

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00402 Published 2026-03-24 Fixed in 2.2.1 CWE-918

TI-2026-26058 CVE-2026-33678 · GHSA-jfmm-mjcp-8wq2

Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

LOW 37

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00318 Published 2026-03-24 Fixed in 2.2.1 CWE-639

TI-2026-26057 CVE-2026-33677 · GHSA-7c2g-p23p-4jg3

Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00302 Published 2026-03-24 Fixed in 2.2.1 CWE-200

TI-2026-26056 CVE-2026-33676 · GHSA-8cmm-j6c4-rr8v

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00362 Published 2026-03-24 Fixed in 2.2.1 CWE-863

TI-2026-26055 CVE-2026-33675 · GHSA-g66v-54v9-52pr

Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00277 Published 2026-03-24 Fixed in 2.2.1 CWE-918

TI-2026-26048 CVE-2026-33668 · GHSA-94xm-jj8x-3cr4

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

LOW 32

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00461 Published 2026-03-24 Fixed in 2.2.1 CWE-285

TI-2026-25870 CVE-2026-33474 · GHSA-wc83-79hj-hpmq

Vikunja Affected by DoS via Image Preview Generation

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00324 Published 2026-03-24 Fixed in 2.2.0 CWE-400

TI-2026-25869 CVE-2026-33473 · GHSA-p747-qc5p-773r

Vikunja has TOTP Reuse During Validity Window

MEDIUM 59

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00325 Published 2026-03-24 Fixed in 2.2.1 CWE-287

TI-2026-25746 CVE-2026-33336

Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation

MEDIUM 64

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01159 Published 2026-03-24 Fixed in 2.2.0 CWE-94

TI-2026-25745 CVE-2026-33335

Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00257 Published 2026-03-24 Fixed in 2.2.0 CWE-939

TI-2026-25744 CVE-2026-33334

Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

LOW 29

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.004 Published 2026-03-24 Fixed in 2.2.0 CWE-269

TI-2026-25727 CVE-2026-33316 · GHSA-vq4q-79hh-q767

Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

HIGH 70

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00377 Published 2026-03-24 Fixed in 2.2.0 CWE-284

Vulnerabilities

Filters