Vikunja CVE-2026-33677

The CVSS 6.5 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a moderate-to-high risk profile with important contextual factors: the attack vector is network-based with low complexity, but requires low privileges (read-access collaborator status) and no user interaction. The confidentiality impact is rated high since credentials are exposed, but there is no integrity or availability impact. The requirement for authenticated access (PR:L) significantly reduces the attacker pool compared to unauthenticated exploits. No active exploitation in the wild has been reported in publicly available intelligence sources, and no EPSS or KEV status indicators are noted in the provided data. However, the presence of a clear patch (version 2.2.1) and public GitHub advisory suggests this was responsibly disclosed. The real-world risk is elevated for organizations using Vikunja with shared projects containing external webhook integrations—particularly where read-only collaborators may be untrustworthy or where webhook credentials grant broad permissions on external systems.

An attacker with read-only access to a Vikunja project (obtained through invitation or social engineering) sends a GET request to /api/v1/projects/:project/webhooks and receives the API response containing plaintext BasicAuth credentials in the basic_auth_user and basic_auth_password fields. The attacker then uses these credentials to authenticate against the external webhook receiver endpoint (e.g., a CI/CD system, monitoring platform, or custom application), potentially gaining unauthorized access to trigger pipeline builds, modify configurations, or exfiltrate sensitive data. This scenario is feasible due to the low complexity and lack of required user interaction (AV:N/AC:L/UI:N).