EUVD-2026-14916Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) indicates a network-based attack with low complexity that requires low privilege (authenticated user) and produces low confidentiality and availability impact with scope change. While the base CVSS score of 6.4 falls into the medium severity range, the practical risk must be contextualized: the attack requires an authenticated user to initiate a migration workflow, which is a relatively constrained trigger compared to unauthenticated SSRF flaws. However, the lack of SSRF mitigations means any authenticated user can probe internal infrastructure, potentially discovering metadata about backend services, internal APIs, or misconfigured resources. No KEV/CISA known exploited vulnerability status is indicated in the available intelligence, and no public proof-of-concept code was identified in the references. The availability impact is limited (no denial of service mechanism is evident), but confidentiality impact is real—an attacker can exfiltrate responses from internal endpoints. This is a moderate-priority vulnerability for organizations running Vikunja with untrusted users or where internal network segmentation is weak. |
| Exploit ScenarioDerived | An authenticated user with migration permissions (or an attacker with compromised credentials) initiates a Trello workspace migration into Vikunja. The attacker configures the Trello workspace to include attachment URLs pointing to internal endpoints, such as http://localhost:8080/admin or http://internal-db.local:5432. When Vikunja processes the migration, the DownloadFile function fetches these URLs without validation, and the responses (error pages, metadata, or service banners) are captured and returned as task attachments, revealing internal service topology and configuration details to the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
Vikunja prior to version 2.2.1 contains a Server-Side Request Forgery (SSRF) vulnerability in its migration helper functions that lack HTTP request validation. An authenticated attacker can exploit this by triggering a Todoist or Trello migration, which causes the Vikunja server to fetch arbitrary URLs specified in attachment metadata from third-party APIs, potentially exposing internal network resources and returning their contents as task attachments. The vulnerability requires low privilege (authenticated user) and carries a CVSS score of 6.4 with moderate confidentiality and availability impact across network boundaries.
RemediationAI
Upgrade Vikunja to version 2.2.1 or later immediately, as this version includes SSRF protections in the migration helper functions. The patch is available in the upstream repository at https://github.com/go-vikunja/vikunja/commit/93297742236e3d33af72c993e5da960db01d259e. Until patching is completed, restrict migration functionality to trusted administrator accounts only by enforcing role-based access controls on the Todoist and Trello migration features. Additionally, implement network segmentation to prevent the Vikunja server from reaching internal services—use egress firewall rules to block outbound connections to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1/8, 169.254.0.0/16) and to local metadata services.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the migration module of Vikunja (cpe:2.3:a:go-vikunja:vikunja), specifically in the functions DownloadFile and DownloadFileWithHeaders located in pkg/modules/migration/helpers.go. These functions perform unconstrained HTTP GET requests without SSRF protection mechanisms such as URL validation, private IP range filtering, or DNS rebinding defenses. When users import tasks from third-party platforms like Todoist or Trello via Vikunja's migration feature, the attachment URLs returned by those APIs are passed directly to these download functions without sanitization. This represents a classic CWE-918 (Server-Side Request Forgery) vulnerability where user-controlled or attacker-influenced input (the attachment URLs) is used to construct server-initiated network requests, allowing the attacker to probe internal network topology, access internal services, or retrieve sensitive data from localhost or private IP ranges.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions DownloadFile and DownloadFileWithHeaders in pkg/modules/migration/helpers.go make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.
Executive ViewAI
Organizations using Vikunja should be aware of moderate risk from CVE-2026-33675, a server-side request forgery vulnerability rated CVSS 6.4. Users could be tricked into performing unintended actions. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement egress filtering, block metadata endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Related Vulnerabilities in Vikunja Authorization and Information Disclosure
View all 9Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB