go-vikunja/vikunja Security Advisories | GitStock

high2026-10-09

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

GHSA-m687-p538-r5hp

medium2026-10-09

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

GHSA-fmmf-xq98-g327

medium2026-10-09

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

GHSA-pjr3-86v4-5p7w

medium2026-10-09

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

GHSA-hjx8-qv73-f7cm

medium2026-10-09

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

GHSA-fprf-r6rv-xg99

medium2026-10-09

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

GHSA-4hv6-xc92-j86g

low2026-10-09

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

GHSA-w2ch-4xgr-22ww

medium2026-10-09

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

GHSA-8wvg-r2j4-3737

medium2026-10-09

Vikunja: Cross-project task disclosure through subtask expansion

GHSA-3hc7-r24j-rpwc

medium2026-10-09

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

GHSA-g38j-7v97-x298

high2026-10-09

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

GHSA-wq92-8x3r-fm38 · CVE-2026-91970

high2026-10-09

Vikunja: Unbounded CSV row cardinality permits API process termination

GHSA-pqf9-h8g4-8gmh · CVE-2026-91969

high2026-10-09

Vikunja: Unbounded nested task-filter recursion permits API process termination

GHSA-xxc3-xpmc-vmvr · CVE-2026-91968

high2026-10-09

Vikunja: Denial of service via decompression bomb in the data import

GHSA-w7jp-mf2v-8342 · CVE-2026-91979

medium2026-10-09

Vikunja: Link-share token can enumerate users through the v2 API

GHSA-vfxw-3x8p-2vjr · CVE-2026-91981

medium2026-10-09

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

GHSA-39p5-2wrr-xh29 · CVE-2026-91980

high2026-10-09

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

GHSA-4vh2-39rq-rq8j · CVE-2026-91971

medium2026-10-09

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

GHSA-m469-88xx-8rx2 · CVE-2026-91973

medium2026-10-09

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

GHSA-9rg3-v78m-26q8 · CVE-2026-91983

medium2026-10-09

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

GHSA-w39f-h553-h2mx · CVE-2026-91984