api has 50 CVEs on record. Disclosure cadence is accelerating: 45 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 23. The median CVSS is 6.5 (medium), with 2 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (11) and CWE-639 (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 45 prev 0
Weakness classes
Products
- code.vikunja.io/api 50
Worst active — by depth score
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform57CVE-2026-57458High· 8.1Vikunja is an open-source self-hosted task management platform57CVE-2026-56765Critical· 9.1Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR50CVE-2026-111919Medium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed48CVE-2026-111917Medium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes48
api vulnerabilities
CVEs affecting api, newest first. Open any entry for full detail, references, and exploit status.
50 CVEsRSS
GO-2026-6754NoneVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
GO-2026-6732NoneVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.viku…
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api
GO-2026-6723NoneVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api
GO-2026-6714NoneVikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
CVE-2026-111917Medium· 6.5PoCVikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-111918Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
CVE-2026-111919Medium· 6.5PoCVikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
CVE-2026-111920Medium· 5.4PoCVikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control…
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
CVE-2026-111922High· 6.3PoCVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
CVE-2026-111921Medium· 5.4PoCVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
CVE-2026-57458High· 8.1PoCVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange th…
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-exi…
CVE-2026-62376High· 8.1PoCVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to th…
GHSA-g38j-7v97-x298MediumVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
GHSA-8wvg-r2j4-3737MediumVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
GHSA-3hc7-r24j-rpwcMediumVikunja: Cross-project task disclosure through subtask expansion
Vikunja: Cross-project task disclosure through subtask expansion
GHSA-w2ch-4xgr-22wwLowVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
GHSA-fprf-r6rv-xg99Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
GHSA-4hv6-xc92-j86gMedium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
GHSA-pjr3-86v4-5p7wMedium· 5.4Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
GHSA-hjx8-qv73-f7cmMedium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
GHSA-fmmf-xq98-g327MediumVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
GHSA-m687-p538-r5hpHighVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
GHSA-jmr8-r558-3jhxMedium· 4.3Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth
Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth
GHSA-ccgq-fx7h-2v4cMedium· 4.3Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
GHSA-37rx-7pj5-p885High· 7.5Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
GHSA-phph-c358-5mwmMedium· 4.3Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
GHSA-p2vv-wrh8-x466High· 7.5Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
GHSA-69rj-q3v9-vffpHigh· 6.5Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
GHSA-2922-qgfj-pr7vMedium· 4.3Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project