EUVD-2026-14917
GHSA-8cmm-j6c4-rr8v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the related_tasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.
AnalysisAI
Vikunja prior to version 2.2.1 suffers from an information disclosure vulnerability where the API returns full task object details in the related_tasks field without validating the requesting user's read permissions on the related tasks' projects. An authenticated attacker can exploit cross-project task relationships to enumerate sensitive task metadata (titles, descriptions, due dates, priorities, completion percentages, project IDs) from projects they have no access to, achieving a high-confidence information disclosure with CVSS 6.5 and no active exploitation reported in known exploit databases.
Technical ContextAI
The vulnerability stems from insufficient access control checks (CWE-863: Incorrect Authorization) in Vikunja's task relationship handling logic. Vikunja is a self-hosted task management platform that supports cross-project task relations via a related_tasks field. The affected product line is identified by CPE cpe:2.3:a:go-vikunja:vikunja:*:*:*:*:*:*:*:* with versions prior to 2.2.1. When the API endpoint returns task objects, the serialization process populates related task references with complete task data structures without first performing authorization checks to confirm the requesting user has read access to the project containing each related task. This is a classic case of authorization bypass in REST API response filtering where child/related objects inherit visibility rules from the parent rather than enforcing independent permission checks.
RemediationAI
Upgrade Vikunja to version 2.2.1 or later immediately. The patch is available via the official GitHub repository at https://github.com/go-vikunja/vikunja/pull/2449 and the implementing commit 833f2aec006ac0f6643c41872e45dd79220b9174. For deployments unable to patch immediately, restrict API access to trusted network ranges using firewall rules or a reverse proxy, enforce mutual TLS authentication if applicable, and audit API access logs for suspicious enumeration patterns (repeated requests to related_tasks fields across multiple task IDs). Consider temporarily disabling cross-project task linking features at the application configuration level if the risk profile is particularly high.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulner
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today