CVE-2026-123496Low· 3.3▾ SunlitVikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode e…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.
vikunja < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123494Low· 3.5Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
CVE-2026-123493Medium· 5.4Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123495Medium· 4.6Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
CVE-2026-123498Low· 3.7Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
CVE-2026-123497Medium· 6.8Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
CVE-2026-123500Medium· 6.2Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump