GHSA-p2vv-wrh8-x466High· 7.5▾ TwilightDuplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-m469-88xx-8rx2. This link is maintained to preserve external references.
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
code.vikunja.io/api <= 2.5.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91973High· 7.5Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection
GO-2026-6754NoneVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
GO-2026-6714NoneVikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
GO-2026-6723NoneVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api
GO-2026-6732NoneVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.viku…
CVE-2026-111917Medium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes