code.vikunja.io/api vulnerabilities
CVEs whose affected-version data names the code.vikunja.io/api package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
50 CVEsRSS
GHSA-vcgv-7rvm-m3vpMedium· 4.3Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API
Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API
GHSA-jfw3-2gcf-23r5High· 6.5Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination
Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination
GHSA-55p4-8j34-jv53High· 6.5Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination
Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination
GHSA-c2g7-39fr-cp8qHigh· 6.5Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
CVE-2026-54766MediumVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an authenticated user who can read a source project to place its duplica…
CVE-2026-55064Medium· 4.3Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to…
CVE-2026-55065High· 8.1Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only a…
CVE-2026-55066High· 7.1Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket…
CVE-2026-55067Medium· 5.0Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/model…
GHSA-9xwc-vwww-qqmwHigh· 7.5Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
CVE-2026-76216High· 7.5Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share …
GHSA-9jrx-vmh8-c6xwHigh· 8.1Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
GHSA-p4r4-8cxw-pjx7Critical· 6.5Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-68582Medium· 6.5PoCVikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks)
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view f…
CVE-2026-68581High· 8.1Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a lin…
CVE-2026-35596Medium· 4.3Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
CVE-2026-35597Medium· 5.9Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout
Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout
CVE-2026-35594Medium· 6.5Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
CVE-2026-34727High· 7.4Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path
Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path
CVE-2026-56765Critical· 9.1Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR
Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR