EUVD-2026-14917
GHSA-8cmm-j6c4-rr8v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.5 score reflects a medium-to-high information disclosure risk with attack vector network, low attack complexity, and low privilege requirements (authenticated user needed). The vulnerability requires valid authentication credentials and knowledge of task identifiers with cross-project relationships, reducing opportunistic exploitation likelihood. No public exploit code or proof-of-concept has been referenced in available sources, and the vulnerability does not appear in known exploit databases (KEV status unclear from provided data). However, the technical impact is significant for multi-tenant or sensitive environments where task segregation is a security boundary. The automatable nature of API enumeration means that once a foothold is established, systematic information harvesting of cross-referenced tasks becomes trivial. For organizations using Vikunja in security-sensitive contexts (e.g., managing confidential project workflows), this warrants rapid patching despite the moderate CVSS score, as information disclosure can enable privilege escalation or social engineering attacks. For casual self-hosted instances, the risk is lower but still material. |
| Exploit ScenarioDerived | An authenticated user (such as a contractor with access to one project) discovers via the UI that their assigned task has a cross-project relation to another task. They intercept the API response or construct a direct API request to retrieve that task object and receive the full details including the related task's title, description, due date, and project ID from a restricted project. The attacker then uses this metadata to infer sensitive business information (e.g., upcoming product launches, organizational changes) or social engineer colleagues for further access. Since the attack requires only authentication and knowledge of existing task relationships, any user with valid credentials can execute this exploitation path with minimal technical complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
Vikunja prior to version 2.2.1 suffers from an information disclosure vulnerability where the API returns full task object details in the related_tasks field without validating the requesting user's read permissions on the related tasks' projects. An authenticated attacker can exploit cross-project task relationships to enumerate sensitive task metadata (titles, descriptions, due dates, priorities, completion percentages, project IDs) from projects they have no access to, achieving a high-confidence information disclosure with CVSS 6.5 and no active exploitation reported in known exploit databases.
RemediationAI
Upgrade Vikunja to version 2.2.1 or later immediately. The patch is available via the official GitHub repository at https://github.com/go-vikunja/vikunja/pull/2449 and the implementing commit 833f2aec006ac0f6643c41872e45dd79220b9174. For deployments unable to patch immediately, restrict API access to trusted network ranges using firewall rules or a reverse proxy, enforce mutual TLS authentication if applicable, and audit API access logs for suspicious enumeration patterns (repeated requests to related_tasks fields across multiple task IDs). Consider temporarily disabling cross-project task linking features at the application configuration level if the risk profile is particularly high.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from insufficient access control checks (CWE-863: Incorrect Authorization) in Vikunja's task relationship handling logic. Vikunja is a self-hosted task management platform that supports cross-project task relations via a related_tasks field. The affected product line is identified by CPE cpe:2.3:a:go-vikunja:vikunja:*:*:*:*:*:*:*:* with versions prior to 2.2.1. When the API endpoint returns task objects, the serialization process populates related task references with complete task data structures without first performing authorization checks to confirm the requesting user has read access to the project containing each related task. This is a classic case of authorization bypass in REST API response filtering where child/related objects inherit visibility rules from the parent rather than enforcing independent permission checks.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the related_tasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.
Executive ViewAI
Organizations using Vikunja should be aware of notable risk from CVE-2026-33676, a incorrect authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Vikunja Authorization and Information Disclosure
View all 9Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB