Skip to main content

Vikunja CVE-2026-91980

| EUVDEUVD-2026-78651 MEDIUM
Information Exposure (CWE-200)
2026-09-15 VulnCheck GHSA-2922-qgfj-pr7v
Information Disclosure Vikunja Go Vikunja
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable API but requires an authenticated low-privileged account (PR:L) and valid project edit rights; only confidentiality of team metadata is lost.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Sep 15, 2026 - 16:22 NVD
4.3 (MEDIUM) 5.3 (MEDIUM)
Analysis Generated
Sep 15, 2026 - 16:07 vuln.today
Patch available
Sep 15, 2026 - 16:03 EUVD

DescriptionCVE.org

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams.

AnalysisAI

Vikunja versions before 2.6.0 omit team-level access validation when a team is attached to a project, letting any authenticated user enumerate teams they do not belong to through the project teams endpoint. An attacker with a low-privileged account can supply arbitrary team IDs and receive complete rosters - member names and administrative flags - for unauthorized teams. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a valid, authenticated Vikunja account (CVSS PR:L) and the ability to create or edit at least one project so that a team can be attached via the project teams endpoint - on default self-hosted deployments any normal user who can create a project satisfies this. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent: a network-reachable API, no user interaction, but a required low-privileged account and confidentiality-only impact, with no integrity or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: Vikunja 2.6.0 - upgrade every API server instance to 2.6.0 or later, as stated in the GitHub advisory GHSA-39p5-2wrr-xh29 (https://github.com/go-vikunja/vikunja/security/advisories/GHSA-39p5-2wrr-xh29). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vikunja

View all
CVE-2026-27575 CRITICAL POC
9.1 Feb 25

Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
CVE-2026-27616 HIGH POC
7.3 Feb 25

Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
CVE-2026-27819 HIGH POC
7.2 Feb 25

Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
CVE-2026-27116 MEDIUM POC
6.1 Feb 25

Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
CVE-2026-28268 CRITICAL
9.8 Feb 27

Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
CVE-2026-68582 CRITICAL
9.3 Aug 02

Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any

CVE-2026-56765 CRITICAL
9.3 Jul 10

Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
CVE-2026-91985 HIGH
8.7 Sep 15

Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,

CVE-2026-91973 HIGH
8.7 Sep 15

Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
CVE-2026-91972 HIGH
8.7 Sep 15

Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
CVE-2026-68581 HIGH
8.6 Aug 02

Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
CVE-2026-33678 HIGH
8.1 Mar 24

Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulner

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-91980 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy